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Abstract. Quantum states are very delicate, so it is likely some sort of quan- 
tum error correction will be necessary to build reliable quantum computers. 
The theory of quantum error-correcting codes has some close ties to and some 
striking differences from the theory of classical error-correcting codes. Many 
quantum codes can be described in terms of the stabilizer of the codewords. 
The stabilizer is a finite Abelian group, and allows a straightforward character- 
ization of the error-correcting properties of the code. The stabilizer formalism 
for quantum codes also illustrates the relationships to classical coding theory, 
particularly classical codes over GF(4), the finite field with four elements. To 
build a quantum computer which behaves correctly in the presence of errors, we 
also need a theory of fault-tolerant quantum computation, instructing us how 
to perform quantum gates on qubits which are encoded in a quantum error- 
correcting code. The threshold theorem states that it is possible to create a 
quantum computer to perform an arbitrary quantum computation provided 
the error rate per physical gate or time step is below some constant threshold 
value. 



1. Background: the need for error correction 

Quantum computers have a great deal of potential, but to realize that potential, 
they need some sort of protection from noise. 

Classical computers don't use error correction. One reason for this is that 
classical computers use a large number of electrons, so when one goes wrong, it is 
not too serious. A single qubit in a quantum computer will probably be just one, 
or a small number, of particles, which already creates a need for some sort of error 
correction. 

Another reason is that classical computers are digital: after each step, they 
correct themselves to the closer of or 1. Quantum computers have a continuum 
of states, so it would seem, at first glance, that they cannot do this. For instance, 
a likely source of error is over-rotation: a state a|0) -I- /3|1) might be supposed to 
become a|0) + /3e''^|l), but instead becomes a\0) + /3e'('^+*')|l). The actual state 
is very close to the correct state, but it is still wrong. If we don't do something 
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about this, the smaU errors wiU build up over the course of the computation, and 
eventuaUy wiU become a big error. 

Furthermore, quantum states are intrinsicaUy dehcate: looking at one collapses 
it. a|0) becomes |0) with probability jap and |1) with probability |/3p. The 

environment is constantly trying to look at the state, a process called decoherence. 
One goal of quantum error correction will be to prevent the environment from 
looking at the data. 

There is a well-developed theory of classical error-correcting codes, but it 
doesn't apply here, at least not directly. For one thing, we need to keep the phase 
correct as well as correcting bit flips. There is another problem, too. Consider the 
simplest classical code, the repetition code: 

(1) ^ 000 

(2) 1^111 

It will correct a state such as 010 to the majority value (becoming 000 in this case)Q 
We might try a quantum repetition code: 

(3) m ^ m ® w ® 1^) 

However, no such code exists because of the No-Cloning theorem |17^ |54| : 

Theorem 1 (No-Cloning). There is no quantum operation that takes a state 
to (g) Itp) for all states {ip). 

Proof. This fact is a simple consequence of the linearity of quantum mechan- 
ics. Suppose we had such an operation and 1-0) and {(j)) are distinct. Then, by the 
definition of the operation, 

(4) 

(5) 10) -10)10) 

(6) |^)-K|0)^(|V') + I0»(I^) + I0))- 

(Here, and frequently below, I omit normalization, which is generally unimportant.) 
But by linearity, 

(7) 1^) + 10) ^ 1^)1^) + 10)10). 
This differs from ([6]) by the crossterm 

(8) 1^)10) -f 10)1^). 

□ 

2. Basic properties and structure of quantum error correction 

2.1. The nine-qubit code. To solve these problems, we will try a variant of 
the repetition code 



(9) |0) ^ |0) = (1000) + |111)) (1000) + |111)) (1000) + |111)) 

(10) |1) - |T) = (1000) - 1111)) (1000) - 1111)) (1000) - 1111)) 



^Actually, a classical digital computer is using a repetition code - each bit is encoded in 
many electrons (the repetition), and after each time step, it is returned to the value held by the 
majority of the electrons (the error correction). 
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Identity ^ = ( J l) ^1°) = 1°) 

Bit Flip ^=('1' J) X\a)^\a®l) 

Phase Flip ^ = -1 ) ^'"^ " (-l)la) 

Bit & Phase >"=(^^ V)"*^^ r|a) = i(-l)"|a® 1) 
Table 1 . The Pauh matrices 



Note that this does not violate the No-Cloning theorem, since an arbitrary 
codeword will be a linear superposition of these two states 

(11) a|0) + /3|T) ^ [a(|000) + |111)) + /3(|000) - |111))]^^ . 

The superposition is linear in a and (3. The complete set of codewords for this (or 
any other) quantum code form a linear subspace of the Hilbert space, the coding 
space. 

The inner layer of this code corrects bit flip errors: We take the majority within 
each set of three, so 



(12) |010)±|101)^ 

The outer layer corrects phase flip errors: 
so 

(13) (|-) + |-))(|-)-|-))(|-) + |-))- 



|000) ± |111). 

We take the majority of the three signs, 
(|-> + |-»(|-> + |-»(|-> + |-»- 



Since these two error correction steps are independent, the code also works if there 
is both a bit flip error and a phase flip error. 

Note that in both cases, we must be careful to measure just what we want to 
know and no more, or we would collapse the superposition used in the code. I'll 
discuss this in more detail in section [231 

The bit flip, phase flip, and combined bit and phase flip errors are important, so 
let's take a short digression to discuss them. We'll also throw in the identity matrix, 
which is what we get if no error occurs. The definitions of these four operators are 
given in table[T] The factor of i in the definition of Y has little practical significance 
— overall phases in quantum mechanics are physically meaningless — but it makes 
some manipulations easier later. It also makes some manipulations harder, so either 
is a potentially reasonable convention. 

The group generated by tensor products of these 4 operators is called the Pauli 
group. X, Y, and Z anticommute: XZ — —ZX (also written {X,Z} = 0). Sim- 
ilarly, {X, y} = and {Y,Z} — 0. Thus, the n-qubit Pauli group Vn consists of 
the 4" tensor products of /, X, Y, and Z, and an overall phase of ±1 or ±i, for 
a total of 4"+^ elements. The phase of the operators used is generally not very 
important, but we can't discard it completely. For one thing, the fact that this is 
not an Abelian group is quite important, and we would lose that if we dropped the 
phase! 

Vn is useful because of its nice algebraic properties. Any pair of elements of 
Vn either commute or anticommute. Also, the square of any element of Vn is ±1. 
We shall only need to work with the elements with square -1-1, which are tensor 



4 



DANIEL GOTTESMAN 



products of /, X, Y, and Z with an overaU sign ±1; the phase i is only necessary 
to make Vn a group. Define the weight wt{Q) of an operator Q G Vn to be the 
number of tensor factors which are not /. Thus, X (E)Y (g) I has weight 2. 

Another reason the Pauli matrices are important is that they span the space 
of 2 X 2 matrices, and the n-qubit Pauli group spans the space of 2" x 2" matrices. 
For instance, if we have a general phase error 

^4) ng/2 - „ ,g ] - e ' 



- 1^ - ^ e'«/2 

(again, the overall phase does not matter) , we can write it as 

9 6 

(15) i?e/2 = cos - / - isin- Z. 

It turns out that our earlier error correction procedure will also correct this 
error, without any additional effort. For instance, the earlier procedure might use 
some extra qubits {ancilla qubits) that are initialized to |0) and record what type 
of error occurred. Then we look at the ancilla and invert the error it tells us: 

(16) Z (a|0) + (3\l)) ® |0)a„c ^ Z (a|0) + /3|T)) ® |Z)a„c 

(17) (a|0)+/3|T))®|Z)a„c 

(18) / (a|0) + /3|T)) |0)a„c / (a|0) + /3|T)) ® |no error)anc 

(19) -> (a|0) + ® |no error)a„c 

When the actual error is i?e/2j recording the error in the ancilla gives us a 
superposition: 

(20) cos ^ / (a|0) + ® |no error)anc -isin^Z {a\0) + f3\l)) ® |Z)a„c 
Then we measure the ancilla, which with probability sin^ 9/2 gives us 

(21) Z(a|O)+/3|T))0|Z)anc, 

and with probability cos^ 9/2 gives us 

(22) I (a|0) + f3\l)) (E) |no error)a„c. 

In each case, inverting the error indicated in the ancilla restores the original state. 
It is easy to see this argument works for any linear combination of errors 



Theorem 2. If a quantum code corrects errors A and B, it also corrects any 
linear combination of A and B. In particular, if it corrects all weight t Pauli errors, 
then the code corrects all t-qubit errors. 

So far, we have only considered individual unitary errors that occur on the 
code. But we can easily add in all possible quantum errors. The most general 
quantum operation, including decoherence, interacts the quantum state with some 
extra qubits via a unitary operation, then discards some qubits. This process can 
turn pure quantum states into mixed quantum states, which are normally described 
using density matrices. We can write the most general operation as a transformation 
on density matrices 



(23) p^Y^^^P^l 
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where the EiS are normahzed so ^ EjEi ~ I. The density matrix p can be con- 
sidered to represent an ensemble of pure quantum states each of which, in 
this case, should be in the coding space of the code. Then this operation simply 
performs the following operation on each \^): 

(24) lip) E,\tp) with probability \E,\il;)f. 

If we can correct each of the individual errors Ei, then we can correct this general 
error as well. For instance, for quantum operations that only affect a single qubit 
of the code, Ei will necessarily be in the linear span of /, X, Y, and Z, so we can 
correct it. Thus, in the statement of theorem [21 "all i-qubit errors" really does 
apply to all i-qubit errors, not just unitary ones. 

We can go even further. It is not unreasonable to expect that every qubit in 
our nine-qubit code will be undergoing some small error. For instance, qubit i 
experiences the error / + eEi, where Ei is some single-qubit error. Then the overall 
error is 

(25) (g)(/ + eE,)^I + e {Ei ® + / ® £^2 ® + ■ ■ •) + O(e') 

That is, to order e, the actual error is the sum of single-qubit errors, which we 
know the nine-qubit code can correct. That means that after the error correction 
procedure, the state will be correct to O(e^) (when the two-qubit error terms begin 
to become important). While the code cannot completely correct this error, it still 
produces a significant improvement over not doing error correction when e is small. 
A code correcting more errors would do even better. 

2.2. General properties of quantum error-correcting codes. Let us 

try to understand what properties are essential to the success of the nine-qubit 
code, and derive conditions for a subspace to form a quantum error-correcting code 
(QECC). 

One useful feature was linearity, which will be true of any quantum code. We 
only need to correct a basis of errors (/, X, Y, and Z in the one-qubit case), and 
all other errors will follow, as per theorem [2l 

In any code, we must never confuse |0) with |1), even in the presence of errors. 
That is, E\0) is orthogonal to i^|T): 

(26) (0|£;^F|T) = 0. 

It is sufficient to distinguish error E from error F when they act on |0) and |1). 
Then a measurement will tell us exactly what the error is and we can correct it: 

(27) {0\E^Fm = (T|£:^F|T) = 
for E^F. 

But ()27p is not necessary: in the nine-qubit code, we cannot distinguish between 
Zi and Z2, but that is OK, since we can correct either one with a single operation. 
To understand the necessary condition, it is helpful to look at the operators Fi = 
{Zi + Z2)/2 and F2 = {Zi — ^2)/2 instead of Zi and ^2. Fi and F2 span the same 
space as Zi and Z2, so Shor's code certainly corrects them; let us try to understand 
how. When we use the Fs as the basis errors, now equation ([27]) is satisfied. That 
means we can make a measurement and learn what the error is. We also have to 
invert it, and this is a potential problem, since Fi and F2 are not unitary. However, 
Fi acts the same way as Zi on the coding space, so zl suffices to invert Fi on the 
states of interest. F2 acts the same way as the operator on the coding space. We 
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can't invert this, but we don't need to — since F2 annihilates codewords, it can 
never contribute a component to the actual state of the system. 

The requirement to invert the errors produces a third condition: 

(28) (0|£;ts|0) = (J\E'^E\\). 

Either this value is nonzero, as for i^i, in which case some unitary operator will act 
the same way as E on the coding space, or it will be zero, as for in which case 
E annihilates codewords and never arises. 

These arguments show that if there is some basis for the space of errors for 
which equations (|26p. (|77|) . and hold, then the states |0) and |1) span a quantum 
error-correcting code. Massaging these three equations together and generalizing 
to multiple encoded qubits, we get the following theorem [8l I31j : 

Theorem 3. Suppose £ is a linear space of errors acting on the Hilhert space 
Ti. Then a suhspace C of Ti forms a quantum error- correcting code correcting the 
errors £ iff 

(29) {m^E\4,) = C{E) 

for all E Cz £ ■ The function C{E) does not depend on the state . 

Proof. Suppose {Ea] is a basis for £ and is a basis for C. By setting 

E and |V') equal to the basis elements and to the sum and difference of two basis 
elements (with or without a phase factor i), we can see that (|29p is equivalent to 

(30) {■^,\ElEi\'iljj) = Cab5,,, 

where Cab is a Hermitian matrix independent of i and j. 

Suppose equation ([50)) holds. We can diagonalize Cab- This involves choosing 
a new basis {Fa} for £, and the result is equations ([26)) . (|27p. and ([28)1 . The 
arguments before the theorem show that we can measure the error, determine it 
uniquely (in the new basis), and invert it (on the coding space). Thus, we have a 
quantum error-correcting code. 

Now suppose we have a quantum error-correcting code, and let |?/') and \(j)) be 
two distinct codewords. Then we must have 

(31) {ME^E\^) = {cji\E^E\4,) 

for all E. That is, ([29l) must hold. If not, E changes the relative size of jV') and 
10). Both 1-0) -I- 10) and 1-0) -f c|0) are valid codewords, and 

(32) E{\i,) + \4>))^Nm+c\4>)), 
where is a normalization factor and 

(33) c={i^\E^E\^)/{(l>\E^E\4>). 

The error E will actually change the encoded state, which is a failure of the code, 
unless c = 1. 

□ 

There is a slight subtlety to the phrasing of equation (|29|) . We require £ to be 
a linear space of errors, which means that it must be closed under sums of errors 
which may act on different qubits. In contrast, for a code that corrects t errors, 
in (|30l) . it is safe to consider only Ea and Eb acting on just t qubits. We can restrict 
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even further, and only use Pauli operators as Ea and Eb, since they wiU span the 
space of i-qubit errors. This leads us to a third variation of the condition: 



This can be easily interpreted as saying that no measurement on 2t qubits can learn 
information about the codeword. Alternatively, it says we can detect up to 2t errors 
on the code without necessarily being able to say what those errors are. That is, 
we can distinguish those errors from the identity. 

If the matrix Cab in (|30[) has maximum rank, the code is called nondegenerate. 
If not, as for the nine-qubit code, the code is degenerate. In a degenerate code, 
different errors look the same when acting on the coding subspace. 

For a nondegenerate code, we can set a simple bound on the parameters of 
the code simply by counting states. Each error E acting on each basis codeword 
IV'i) produces a linearly independent state. All of these states must fit in the full 
Hilbert space of n qubits, which has dimension 2". If the code encodes k qubits, 
and corrects errors on up to t qubits, then 



The quantity in parentheses is the number of errors of weight t or less: that is, the 
number of tensor products of /, X, Y , and Z that are the identity in all but t or 
fewer places. This inequality is called the quantum Hamming hound. While the 
quantum Hamming bound only applies to nondegenerate codes, we do not know of 
any codes that beat it. 

For t = 1, k = 1, the quantum Hamming bound tells us n > 5. In fact, there 
is a code with n = 5, which you will see later. A code that corrects t errors is said 
to have distance 2t + 1, because it takes 2t + \ single-qubit changes to get from 
one codeword to another. We can also define distance as the minimum weight of 
an operator E that violates equation (|34p (a definition which also allows codes of 
even distance) . A quantum code using n qubits to encode k qubits with distance d 
is written as an [[n, code (the double brackets distinguish it from a classical 
code). Thus, the nine-qubit code is a [[9,1,3]] code, and the five-qubit code is a 
[[5,1,3]] code. 

We can also set a lower bound telling us when codes exist. I will not prove this 
here, but an [[n, A;,d]] code exists when 



(known as the quantum Gilbert- Varshamov bound |12) V This differs from the 
quantum Hamming bound in that the sum goes up to d — 1 (which is equal to 2t) 
rather than stopping at t. 

Theorem 4. A quantum [[n, fc,(i]] code exists when hSG^) holds. Any nondegen- 
erate [[n, /c,d]] code must satisfy Ii35\). For large n, R — k/n and p = dl2n fixed, 
the best nondegenerate quantum codes satisfy 




(35) 




(36) 




(37) 



1 - 2plog2 3 - H{2p) <R<1 - plog2 3 - H{p), 
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where H{x) — — xlogj x — {1 ~ x) log2(l — x). 

One further bound, known as the KniU-Laflamme bound [31] or the quan- 
tum Singleton bound, apphes even to degenerate quantum codes. For an [[n, fc,c?]] 
quantum code, 

(38) n - k>2d-2. 

This shows that the [[5, 1, 3]] code really is optimal — a [[4, 1, 3]] code would violate 
this bound. 

I will not prove the general case of this bound, but the case of fc = 1 can be 
easily understood as a consequence of the No-Cloning theorem. Suppose r qubits 
of the code are missing. We can substitute |0) states for the missing qubits, but 
there are r errors on the resulting codeword. The errors are of unknown type, but 
all the possibilities are on the same set of r qubits. Thus, all products ElEb in 
condition ([30|) have weight r or less, so this sort of error (an "erasure" error |25j ) 
can be corrected by a code of distance r + 1. Now suppose we had an [[n, 1, d]] code 
with n < 2d — 2. Then we could split the qubits in the code into two groups of 
size at most d — 1. Each group would have been subject to at most d — 1 erasure 
errors, and could therefore be corrected without access to the other group. This 
would produce two copies of the encoded state, which we know is impossible. 

2.3. Stabilizer codes. Now let us return to the nine-qubit code, and examine 
precisely what we need to do to correct errors. 

First, we must determine if the first three qubits are all the same, and if not, 
which is different. We can do this by measuring the parity of the first two qubits 
and the parity of the second and third qubits. That is, we measure 

(39) Z (g) Z (g) / and / (g) Z (g) Z. 

The first tells us if an X error has occurred on qubits one or two, and the second 
tells us if an X error has occurred on qubits two or three. Note that the error 
detected in both cases anticommutes with the error measured. Combining the two 
pieces of information tells us precisely where the error is. 

We do the same thing for the other two sets of three. That gives us four more 
operators to measure. Note that measuring Z (g Z gives us just the information we 
want and no more. This is crucial so that we do not collapse the superpositions 
used in the code. We can do this by bringing in an ancilla qubit. We start it in the 
state |0) -I- |1) and perform controUed-Z operations to the first and second qubits 
of the code: 

(40) (|0) + \l))Y,Cabc\abc) ^ ^Cafc, {\0)\abc) + (-l)"®^|l)|a5c)) 

abc abc 

(41) =Y.Cabc (|0) + (_l)P-ity(a,b)|^^^ 1^^^^^ 

abc 

At this point, measuring the ancilla in the basis |0) ± |1) will tell us the eigenvalue 
of Z (g Z (g /, but nothing else about the data. 

Second, we must check if the three signs are the same or different. We do this 
by measuring 



(42) 



X0X(gX(gX0X0X0/(g/(g/ 
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Table 2. The stabilizer for the nine-qubit code. Each column 
represents a different qubit. 



and 

(43) I®I®I®X®X®X®X®X®X. 

This gives us a total of 8 operators to measure. These two measurements detect 
Z errors on the first six and last six qubits, correspondingly. Again note that the 
error detected anticommutes with the operator measured. 

This is no coincidence: in each case, we are measuring an operator M which 
should have eigenvalue +1 for any codeword: 

(44) A-m = lij). 

If an error E which anticommutes with M has occurred, then the true state is E\tp), 
and 

(45) M {E\i})) = -EM\ij) = -E\i}). 

That is, the new state has eigenvalue —1 instead of +1. We use this fact to correct 
errors: each single-qubit error E anticommutes with a particular set of operators 
{M}; which set, exactly, tells us what E is. 

In the case of the nine-qubit code, we cannot tell exactly what E is, but it does 
not matter. For instance, we cannot distinguish Zi and Z2 because 

(46) ZiZ2\^) = \^) ^ Zi\iP) = Z2\^). 

This is an example of the fact that the nine-qubit code is degenerate. 

Table [2] summarizes the operators we measured. These 8 operators generate an 
Abelian group called the stabilizer of the nine-qubit code. The stabilizer contains 
all operators M in the Pauli group for which M\ip) — for all \tp) in the code. 

Conversely, given an Abelian subgroup S of the Pauli group Vn (which, if you 
recall, consists of tensor products of /, X, Y, and Z with an overall phase of ±1, ±i), 
we can define a quantum code T{S) as the set of states for which M|V') = IV') 
for all M ^ S. S must be Abelian and cannot contain —1, or the code is trivial: If 
M, N eS, 

(47) MN\tP) = M\^P) = {t/j) 

(48) NMltP) = N\^P) = IV-) 
so 

(49) [M, N]\i}) = MN\tP) - NM\tP) = 0. 

Since elements of the Pauli group either commute or anticommute, [M, N] = 0. 
Clearly, ii M — —1 E S, there is no nontrivial for which M\^) = \tp). 
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If these conditions are satisfied, there wiU be a nontrivial subspace consisting of 
states fixed by aU elements of the stabiHzer. We can tell how many errors the code 
corrects by looking at operators that commute with the stabilizer. We can correct 
errors E and F if either F e S (so E and F act the same on codewords), or if 
3AI e S s.t. {M, E^F} = 0, in which case measuring the operator M distinguishes 
between E and F. If the first condition is ever true, the stabilizer code is degenerate; 
otherwise it is nondegenerate. 

We can codify this by looking at the normalizer N{S) of S in the Pauli group 
(which is in this case equal to the centralizer, composed of Pauli operators which 
commute with S) . The distance d of the code is the minimum weight of any operator 



Theorem 5. Let S be an Abelian subgroup of order 2°" of the n-qubit Pauli 
group, and suppose —1 ^ S. Let d be the minimum weight of an operator in 
N{S) \ S . Then the space of states T{S) stabilized by all elements of S is an 
[[n, n — a, d]] quantum code. 

To correct errors of weight [d— 1)/2 or below, we simply measure the generators 
of S. This will give us a list of eigenvalues, the error syndrome^ which tells us 
whether the error E commutes or anticommutes with each of the generators. The 
error syndromes of E and F are equal iff the error syndrome of E'^ F is trivial. For 
a nondegenerate code, the error syndrome uniquely determines the error E (up to 
a trivial overall phase) — the generator that anticommutes with E'^ F distinguishes 
E from F . For a degenerate code, the error syndrome is not unique, but error 
syndromes are only repeated when E'^ F G S*, implying E and F act the same way 
on the codewords. 

If the stabilizer has a generators, then the code encodes n — a qubits. Each 
generator divides the allowed Hilbert space into +1 and —1 eigenspaces of equal 
sizes. To prove the statement, note that we can find an element G of the Pauli group 
that has any given error syndrome (though G may have weight greater than (d — 
l)/2, or even greater than d). Each G maps T{S) into an orthogonal but isomorphic 
subspace, and there are 2° possible error syndromes, so T(S) has dimension at most 
2"'/2°. In addition, the Pauli group spans f7(2"), so its orbit acting on any single 
state contains a basis for Ti.. Every Pauli operator has some error syndrome, so 
T{S) has dimension exactly 2"~°-. 

3. More quantum error-correcting codes and their structure 

3.1. Some other important codes. Stabilizers make it easy to describe 
new codes. For instance, we can start from classical coding theory, which describes 
a linear code by a generator matrix or its dual, the parity check matrix. Each 
row of the generator matrix is a codeword, and the other codewords are all linear 
combinations of the rows of the generator matrix. The rows of the parity check 
matrix specify parity checks all the classical codewords must satisfy. (In quantum 
codes, the stabilizer is closely analogous to the classical parity check matrix.) One 
well-known code is the seven-bit Hamming code correcting one error, with parity 
check matrix 



iiiN{S)\S [121 120] . 



(50) 




11110 
110 110 
10 10 10 1 
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Table 3. Stabilizer for the seven-qubit code. 



If we replace each 1 in this matrix by the operator Z , and by /, we are really 
changing nothing, just specifying three operators that implement the parity check 
measurements. The statement that the classical Hamming code corrects one error 
is the statement that each bit flip error of weight one or two anticommutcs with 
one of these three operators. 

Now suppose we replace each 1 by X instead of Z . We again get three operators, 
and they will anticommute with any weight one or two Z error. Thus, if we make a 
stabilizer out of the three Z operators and the three X operators, as in table [31 we 
get a code that can correct any single qubit error |46| . X errors are picked up by 
the first three generators, Z errors by the last three, and Y errors are distinguished 
by showing up in both halves. Of course, there is one thing to check: the stabilizer 
must be Abelian; but that is easily verified. The stabilizer has 6 generators on 7 
qubits, so it encodes 1 qubit — it is a [[7, 1, 3]] code. 

In this example, we used the same classical code for both the X and Z genera- 
tors, but there was no reason we had to do so. We could have used any two classical 
codes Ci and C2 |14|, 147] . The only requirement is that the X and Z generators 
commute. This corresponds to the statement that C Ci (C^ is the dual code to 
C2, consisting of those words which are orthogonal to the codewords of C2). If Ci is 
an [n, fci, di] code, and C2 is an [n, ^2, 6^2] code (recall single brackets means a classi- 
cal code), then the corresponding quantum code is an [[n, ki + k2 — n, min((ii, 1^2)]] 
codeH This construction is known as the CSS construction after its inventors 
Calderbank, Shor, and Steane. 

The codewords of a CSS code have a particularly nice form. They all must 
satisfy the same parity checks as the classical code Ci, so all codewords will be 
superpositions of words of Ci. The parity check matrix of C2 is the generator 
matrix of C^, so the X generators of the stabilizer add a word of to the state. 
Thus, the codewords of a CSS code are of the form 



where u E Ci (C^ C Ci, so u + w G Ci). If we perform a Hadamard transform 



(51) 




(52) 
(53) 



|0) 
|1> 



|0) + |1) 
|0> - 11) 



In fact, the true distance of the code could be larger than expected because of the possibility 
of degeneracy, which would not have been a factor for the classical codes. 
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Table 4. The stabilizer for the five-qubit code. 



on each qubit of the code, we switch the Z basis with the X basis, and Ci with C2, 
so the codewords are now 

(54) 1" + ^) (weCz). 

Thus, to correct errors for a CSS code, we can measure the parities of Ci in the Z 
basis, and the parities of C2 in the X basis. 

Another even smaller quantum code is the [[5, 1, 3]] code I promised earlier [8t 
134] . Its stabilizer is given in table [H I leave it to you to verify that it commutes 
and actually does have distance 3. You can also work out the codewords. Since 
multiplication by M € S merely rearranges elements of the group S, the sum 

(55) (E^V^ 

is in the code for any state |(/)). You only need find two states |(/)) for which ([55|) is 
nonzero. Note that as well as telling us about the error-correcting properties of the 
code, the stabilizer provides a more compact notation for the coding subspace than 
listing the basis codewords. 

A representation of stabilizers that is often useful is as a pair of binary matrices, 
frequently written adjacent with a line between them (12) . The first matrix has a 
1 everywhere the stabilizer has an X or a y, and a elsewhere; the second matrix 
has a 1 where the stabilizer has a F or a Z. Multiplying together Pauli operators 
corresponds to adding the two rows for both matrices. Two operators M and 
N commute iff their binary vector representations (ai|6i), (a^^^'i) are orthogonal 
under a symplectic inner product: a\hi + h\a2 = 0. For instance, the stabilizer for 
the five-qubit code becomes the matrix 

M 



1 

1 / 

As an example of an application of this representation, let us prove a fact used 
above: 

Lemma 1. Given any stabilizer S, there is always at least one error with any 
given error syndrome. 

Proof. Suppose 5* has a generators. The error syndrome of a Pauli operator 
E can be defined as an a-component binary vector with the ith entry indicating 
whether the ith generator of S commutes with E (the ith bit is 0) or anticommutes 
(the ith bit is 1). Thus, if Xi is the binary vector representing the ith generator 
of S and e is the binary vector representing E, then E has error syndrome v iff 
Xi Q e = Vi, where is the symplectic inner product. The generators of S give 



(56) 
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Stabilizers GF(4) 



I 
Z 
X 
Y 

tensor products 

multiplication addition 
[M, TV] = tr(M • iV) = 

N{S) dual 
Table 5. Connections between stabilizer codes and codes over GF(4). 




1 

vectors 



linearly-independent binary vectors, so we have a independent linear equations in 
a 2n-dimensional binary vector space with a < n. By a standard linear algebra 
theorem, these equations must always have a non-zero solution. (In fact, there is a 
whole {2n — a)-dimensional subspace of solutions.) □ 

3.2. Codes over GF(4). The CSS construction is very nice in that it allows 
us to use the immense existing body of knowledge on classical binary codes to 
construct quantum codes. However, CSS codes cannot be as efficient as the best 
stabilizer codes — for instance, there is no [[5, 1, 3]] CSS code. Instead, if we want 
to construct the most general possible stabilizer codes, we should take advantage 
of another connection to classical coding theory. 

Frequently, classical coding theorists consider not just binary codes, but codes 
over larger finite fields. One of the simplest is GF(4), the finite field with four 
elements. It is a field of characteristic 2, containing the elements {0, 1,uj,lu'^}. 

(57) LU^ = 1, LU + LU^ ^1 

It is also useful to consider two operations on GF(4). One is conjugation, which 
switches the two roots of the characteristic polynomial x'^ + x + 1: 

(58) 1 = 1 Lu^uj^ 

(59) = ^ = w 

The other is trace, tr x is the trace of the linear operator "multiplication by a;" 
when GF(4) is considered as a vector space over Z2: 

(60) trO = trl = 

(61) trcj = trtj^ = l 

Stabilizer codes make extensive use of the Pauli group Vn- We can make a 
connection between stabilizer codes and codes over GF(4) by identifying the four 
operators /, X, Y, and Z with the four elements of GF(4), as in tableO [13^- 

The commutativity constraint in the Pauli group becomes a symplectic inner 
product between vectors in GF(4). The fact that the stabilizer is Abelian can be 
phrased in the language of GF(4) as the fact that the code must be contained in its 
dual with respect to this inner product. To determine the number of errors corrected 
by the code, we must examine vectors which are in the dual (corresponding to N{S)) 
but not in the code (corresponding to S). 
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The advantage of making this correspondence is that a great deal of classical 
coding theory instantly becomes available. Many classical codes over GF(4) are 
known, and many of them are self-dual with respect to the symplectic inner prod- 
uct, so they define quantum codes. For instance, the five-qubit code is one such — 
in fact, it is just a Hamming code over GF(4)! Of course, mostly classical coding 
theorists consider linear codes (which are closed under addition and scalar multipli- 
cation) , whereas in the quantum case we wish to consider the slightly more general 
class of additive GF(4) codes (that is, codes which are closed under addition of 
elements, but not necessarily scalar multiplication). 

3.3. Even more quantum error-correcting codes. There are, of course, 
many quantum error-correcting codes that are not stabilizer codes, and a good deal 
of work has been done on other sorts of codes. Usually, you need to assume a 
certain level of structure in order to be able to find and work with a code, and 
there are a number of ways to ensure that you have sufficient structure available. 

One very fruitful way is to consider codes not over qubits, but over higher- 
dimensional registers, qudits. There is a natural generalization of stabilizer codes 
to this case [29], and a variety of qudit stabihzer codes are known (e.g., [H [3 126j). 
Another route is to relax the stabilizer structure slightly and look for more efficient 
qubit codes [15j . One tool that has garnered interest over the last few years is 
known as operator quantum error correction or subsystem codes \33\ I36j . In this 
case, we ignore certain degrees of freedom in the code, essentially encoding a state as 
a linear subspace rather than another state. Subsystem codes offer no improvement 
in the basic error correction properties I have discussed so far, but do sometimes 
help when considering fault tolerance (sections |4] and [5]) . 

Another interesting avenue is to study codes which are completely degenerate. 
Such codes are known by various names, most commonly as decoherence-free sub- 
spaces (or DFS) [35] . If all of the possible errors for a code act as the identity on 
the code subspace, then no active correction operation is needed — no matter what 
error occurs, the state remains unchanged. Usually a DFS is considered for the case 
where errors occur continuously in time, in which case the set of possible errors gen- 
erates a Lie algebra, and the DFS is then a degeneracy of the trivial representation 
of the Lie algebra acting on the Hilbert space of n qubits. One advantage of a DFS 
is that it continues to function even at very high noise levels, but decoherence-free 
subspaces have the disadvantage that a non-trivial DFS only exists for certain very 
special noise models (although some, such as collective noise, have practical signif- 
icance). In contrast, a more general QECC can reduce the effective error rate for a 
wide variety of types of noise, but only if the error rate is sufficiently low to begin 
with. 

Of course, one can even go beyond quantum error correction to study other 
methods of protecting qubits against noise. For instance, in dynamical decou- 
pling |53j , a series of quick operations is performed which cause the noise to cancel 
itself out. Dynamical decoupling only works when the noise is slowly varying com- 
pared to the rate at which we can perform operations. It has two advantages: 
like a DFS, dynamical decoupling functions well even at relatively high error rates, 
but unlike a DFS or QECC, dynamical decoupling does not require any additional 
qubits. 

The problem of eliminating errors from a quantum computer is a difficult one, 
and we will want to use every tool that we can bring to bear on the problem. Most 
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likely, this will include control techniques like dynamical decoupling as a first layer 
of defense, perhaps followed by specialized error-correcting codes such as a DFS or a 
phase QECC to handle certain dominant error types, with a more general quantum 
error-correcting code as the final protection to deal with any kinds of errors not 
eliminated by the first two layers. However, everything we do — every qubit we 
add, every additional gate we perform — will have errors in it too, so additional 
specialized layers of protection come with a cost, not just in additional overhead, 
but also in additional errors that will need to be cleaned up by the final QECC. It 
can become a difficult balancing act to judge precisely which protections are useful 
and which cause more trouble than they are worth. 

3.4. The logical Pauli group. The group N{S) has already played an im- 
portant role in analyzing a code's ability to correct errors, and it will be nearly as 
important later when we discuss fault-tolerant quantum computation. Therefore, 
it is helpful to pause briefly to further consider its structure. 

The elements of N{S) are those Pauli operators which commute with everything 
in the stabilizer. Consider how E £ N{S) acts on a codeword of the stabilizer code. 
Let M e S; then 

(62) M{E\i})) = EM\'4)) = E\'ii)). 

This is true VM e S, so E\%1)) e T{S). That is, E takes valid codewords to valid 
codewords. Now, \i E £ S itself, that is unsurprising: In that case, it takes valid 
codewords to themselves. 11 E ^ S, this cannot be true — it must take at least one 
codeword to a different codeword. It is a logical operation, acting on the encoded 
state without interfering with the encodingo In general, I will indicate a logical 
operation by drawing a line over it. E.g., X is a bit flip on an individual physical 
qubit, and X is a logical bit flip, which changes an encoded qubit. 

Notice that if = EM, with M e S, then F e N{S) as wefl and F\i;) = 
EM\if) = Elip) for all € T{S). Thus, two Pauli operators in the same coset of 
5' in N{S) act the same way, so the different logical operations in N{S) are actually 
the elements of N{S)/S. Similarly, note that two Pauli operators E and F have 
the same error syndrome iff E and F are in the same coset of N{S) in Vn- There 
is always at least one error with any given error syndrome, and {Vnl — 4"+^, so 
\N{S)\ =4-2"+'= and \N{S)/S\ = 4'=^+i for an [[n,k,d]] code. 

We can in fact identify N{S) / S with the logical Pauli group Vk ■ You can choose 
any maximal Abelian subgroup R of N{S)/S to represent the logical Z operators 
(including tensor products of Za and Is) . The size of a maximal Abelian subgroup 
is 4-2'^', since an Abelian subgroup of N{S)/S corresponds to an Abelian subgroup 
of Vn which is larger by a factor |5| = 2"^'''. By choosing elements of N{S)/S that 
have various syndromes with respect to R, you can also identify logical X operators. 
Of course, in order to make all this work, you need to choose the basis codewords 
appropriately. For instance, the encoded |00 . . .0) state should be a -|-l-eigenstate 
of every element of R. 

3.5. The Clifford group. When working with stabilizer codes, a certain 
group of quantum gates shows up very often. These gates are sufficient to en- 
code and decode stabilizer codes, and play an important role in the theory of 



Incidentally, this proves that the distance d of a stabilizer code is not accidentally higher 
than the distance given in Theorem [5] 
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fault-tolerance. The group is most often known as the Clifford group (although its 
relationship to Clifford algebras is tenuous), and is defined as 

(63) Cn = {U e C/(2") I C/PC/t e Vn VP e P„}. 

That is, the Clifford group is the normalizer of P„ in the unitary group J7(2"). 

Besides being important in the theory of stabilizer codes, the Clifford group is 
interesting in its own right. For one thing, it contains some very common quantum 
gates. The Hadamard transform H, n/A phase rotation P, and CNOT gate are all 
in the Clifford group: 

(^4) A)' ^-(J ^^^^ 

We can work out how each of these gates acts on the Pauli group by conjugation. 
For instance, the Hadamard gate performs the following transformation: 

(65) Z 

X. 

There is no need to specify the action of H on Y , since conjugation is a group 
homomorphism and Y = iXZ. We can therefore immediately determine that 
Y ^ iZX = ~Y . In fact, it turns out that the Clifford group is generated by H, 
P, and CNOT. 

In general, to specify a Clifford group operator [/, it is sufficient to indicate its 
action on a generating set for the Pauli group, such as X and Z acting on each of 
the n qubits. This is true because the Pauli group forms a basis for the 2" x 2" 
matrices, allowing us to learn the action of U on any projector. However, there is 
one remaining ambiguity, since iiU = e^^U' , then U and U' have the same action by 
conjugation. Since this sort of global phase has no physical significance, however, 
this is not a very harmful ambiguity. 

The Clifford group has a binary matrix representation just like stabilizers do. 
Based on the argument of the last paragraph, we can specify a Clifford group ele- 
ment (up to global phase) by specifying its action on the binary vectors correspond- 
ing to the Pauli operators. Since Clifford group elements preserve commutation and 
anti-commutation, they correspond to symplectic matrices over the 2n-dimensional 
binary vector space. In fact, we can say more. The Pauli group Vn is, by definition, 
a normal subgroup of C„, and because Pauli operators either commute or anticom- 
mute, Pauli operators in C„ correspond to the identity symplectic matrix. The 
center Z{Cn) consists of just the diagonal matrices e**^/, and those also correspond 
to the identity symplectic matrix. Let V!^ = Z(Cn)'Pn (that is, the Pauli group, but 
with arbitrary phases, not just ±1, ±i). Then is the kernal of the map from 
the Clifford group to the group Sp{2n,Z2) of 2n x 2n binary symplectic matrices. 
That is, Cn/Vji = Sp(2n,Z2), which says that if we only care about the action of 
the Clifford group up to phases, the Clifford group is effectively just the group of 
symplectic matrices. 

As a consequence of this equivalence, there is an efficient classical simulation 
of any circuit of Clifford group operators acting on an initial stabilizer state with 
final Pauli measurements [22j . Even though the overall action of the circuit is a 
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unitary transformation on a 2"-diniensional Hilbert space, each step can be repre- 
sented as just a 2n X 2n binary matrix, and we can therefore rapidly compute the 
overall circuit action as the product of these matrices. This result can be extended 
to the case where the circuit includes not just unitary Clifford group gates but 
also measurements of Pauli operators in the middle of the circuit, with later gates 
dependent on the outcome of the measurements. 

4. Fault-tolerant gates 

4.1. The need for fault tolerance. There is still a major hurdle before 
we reach the goal of making quantum computers resistant to errors. We must 
also understand how to perform operations on a state encoded in a quantum code 
without losing the code's protection against errors, and how to safely perform error 
correction when the gates used are themselves noisy. A protocol which performs 
these tasks is called fault tolerant (FT for short). Shor presented the first protocols 
for fault-tolerant quantum computation [44j , but there have been some substantial 
improvements since then. Now we know that, provided that the physical error rate 
per gate and per time step is below some constant threshold value, it is possible 
to make the logical quantum computation we wish to perform arbitrarily close to 
correct with overhead that is polylogarithmic in the length of the computation [H 
[281132]. 

Our goal is to produce protocols which continue to produce the correct answer 
even though any individual component of the circuit may fail. The basic compo- 
nents which we need to create a universal quantum computer are 

(1) Preparation: Operations which prepare a new qubit in some standard 
state. It is sufficient to have just one type of preparation that prepares 
a |0) state, although we will actually use a number of different prepared 
states. 

(2) Quantum Gates: A universal set of quantum gates. To have a universal 
set, it is sufficient to use the gates H, CNOT, and the tt/S phase rota- 
tion i?7r/8 = gi7r/4^ • This Set of gates generates a group dense in 
C/(2") [9J. 

(3) Measurement: Measurement of qubits. It is is sufficient to be able to 
measure individual qubits in the standard basis |0), 

(4) Wait: In order to synchronize the operation of gates, we may sometimes 
need to have qubits wait around without performing any action on them. 

The individual qubits making up our quantum error-correcting code are called 
physical qubits, and each of these actions is a physical action (e.g., a physical gate). 
Each instantiation of one of these components is called a physical location (or more 
often just location). The number of locations in a circuit is then at most the total 
number of qubits used times the total number of time steps used. The number of 
locations will frequently be less than the maximum, as we will often prepare new 
qubits during the computation and measure qubits, which can then be discarded, 
before the computation is completed. Note that wait steps count as locations, but 
that operations on classical data (in particular, measurement results) do not, as we 
will assume that classical computation is perfect. Depending on the precise model 
we are using, we may wish to simplify by assuming that modest amounts of classical 
computation take no time, but this is not essential. 
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Any location can fail, including a wait step. We assume that when a location 
fails, it results in an error that can affect all of the qubits involved in the action. In 
the case of preparation, a single-qubit quantum gate, measurement, or wait, that 
is just a single qubit. For a two-qubit quantum gate such as CNOT, we allow an 
arbitrary error acting on the two qubits involved in the gate, including errors which 
entangle the two qubits. The actual error should be considered to be the action of 
the failed component times the inverse of the desired component in that location. 
Thus, if we wish to perform Z, but instead perform Y, the error is YZ = iX. The 
goal of fault tolerance is to take a quantum circuit which is designed to work in the 
absence of errors and modify it to produce a new circuit which produces the same 
output as the original circuit, but with the weaker assumption that the number of 
failed locations is not too large. The precise rules for the probability of locations 
failing and the type of errors produced when a location fails will be discussed in 
section [SJ I will sometimes refer to a location with an error in it as a faulty location. 

The biggest obstacle which we must overcome in order to create a fault-tolerant 
protocol is that of error propagation. Even if the gates we perform are themselves 
perfect, the action of those gates on the state can alter any errors that have already 
occurred and cause them to spread: 



That is, a pre-existing error £^ on a state followed by a correct gate U is 
equivalent to the correct state (C/|-0)), but with an error UEU^. When U is a 
single-qubit gate, this is not a very serious problem, since the weight of E does not 
change, although the exact type of error may now be different. For instance, an X 
error will become a Z error under the action of a Hadamard gate. The troublesome 
case is when [/ is a two-qubit gate, in which case a single-qubit error E will often 
become a two-qubit error. For instance, notice that CNOT can propagate an X 
error from the first qubit to the second, and can propagate Z from the second qubit 
to the first: 



This is a problem because it can increase the weight of an error. For instance, if 
we are using a distance 3 code, it can handle a single-qubit error, but if we then 
perform a CNOT, even if the CNOT itself is perfect, that single-qubit error can 
become a two-qubit error, and our distance 3 code cannot necessarily correct that. 
Since we are not going to be able to make a universal quantum computer using 
only single-qubit gates, clearly we are going to have be very careful as to how we 
use two-qubit gates. 

There is, of course, a solution to this problem, which I will discuss in the 
remainder of the chapter. Fault-tolerant circuits will be designed in such a way as 
to make sure error propagation does not get out of hand. Even though errors may 
spread somewhat, we can still correct the resulting errors, provided there are not 
too many to start with. Our eventual goal is to produce fault-tolerant versions of 
all the types of physical location. I will refer to each such construction as a gadget 
for the particular operation. For instance, we will have fault-tolerant gates for each 
member of a universal set of quantum gates. Each of these gadgets will simulate 
the behavior of the corresponding non-fault-tolerant action, but instead of doing 
so on one or two physical qubits, it will perform the action on the logical qubits 
encoded in a quantum error-correcting code. When we are given a quantum circuit 



(66) 



UE\^) = {UEU^)U\i:). 



(67) 



CNOT : X (g) I ^ X (g) X, I®Z^ Z®Z. 
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which we would like to perform, we replace each of the locations in the original 
circuit with the corresponding fault-tolerant gadget. 

Generally, we assume that the original circuit takes no input: all qubits used 
in it must be prepared using preparation locations. This still allows us to perform 
arbitrary quantum computations, since we can modify the quantum circuit based 
on the classical description of the problem we wish to solve. (For instance, if we 
wish to factor a number N, we could tailor the exact quantum circuit to work with 
N.) Then the final fault-tolerant measurement gadgets will produce classical infor- 
mation which should, if the fault-tolerant circuit has done its work properly, give 
the same outcome as the original circuit would have if we could have implemented 
it without error. 

4.2. Definition of fault tolerance. It is perhaps time to get more precise 
about exactly what we mean by fault tolerance. A fault-tolerant gadget should 
have two basic properties: When the input state to the gadget does not have too 
many errors in it, and there are not too many errors on the physical locations in 
the gadget, the output state should also not have too many errors; and, when there 
are not too many errors in the input state or during the course of the gadget, the 
gadget should perform the correct logical operation on the encoded state. To define 
these properties rigorously, we need to first introduce the notions of an r-filter and 
an ideal decoder [3l. 

Definition 1. An r-filter is a projector onto the subspace spanned by all 
states of the form Q\ip), where \ip) is an arbitrary codeword and Q is a Pauli error 
of weight at most r. An ideal decoder is a map constructed by taking the input 
state and performing a decoding operation (including error correction) consisting 
of a circuit with no faulty locations. 

That is, the r-filter projects onto states with at most r errors. Of course, the 
r-filter has no way of knowing what the correct codeword is at this point of the 
computation, so even a 0-filter might project on the wrong state. The point is that 
the only states that can pass through the r-filter are those which could possibly 
be created from a valid codeword with at most r single-qubit errors. The ideal 
decoder takes the encoded state, corrects any errors, and gives us an unencoded 
state. The ideal decoder gives us a way of talking about the logical state of the 
quantum computer at any point during the computation, and the r-filter makes 
precise the notion of a state having "at most r errors." 

It is convenient to use a graphical notation to represent these objects, as follows: 



The horizontal lines represent a single block of a QECC, except for the one on 
the right end of the ideal decoder symbol, which is a single unencoded qubit. We 
will focus on the case where the code we use is an [[n, l,2t + 1]] code. That is, 
there is just one encoded qubit per block, the code can correct t errors, and the 
thick horizontal lines in the diagrams represent n qubits. It is also possible to 
achieve fault-tolerance with multiple qubits encoded per block [21j . but matters 
are somewhat more complicated then. 




Ideal Decoder 
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We are going to need fault-tolerant gadgets representing state preparation, 
measurement, and gates. (The fault-tolerant "wait" gadget just consists of having 
all the encoded qubits wait.) In addition, we will need to correct errors during the 
course of the computation so that they do not build up to an unacceptable level. 
Naturally, our error correction step also needs to be fault tolerant, since otherwise 
performing error correction would have a substantial risk of creating more errors 
than it fixes. This may still happen if the error rate is too high, but at least by 
designing the error correction step properly, we have a fighting chance of improving 
matters by doing error correction. We will represent all of these gadgets graphically 
as well: 



— Preparation 
— 1^ Measurement 



EC 



Gate U 



Error Correction 



As before, the thick horizontal lines represent a block of an [[n, l,2t + 1]] QECC. 
In the case of the encoded gate, if it is a two-qubit logical gate, the horizontal lines 
represent two blocks of the QECC, each containing one logical qubit involved in the 
gate. The s in each diagram represents the maximum number of faulty locations 
that may be involved in the circuit represented by the graphic. For simplicity, let 
us restrict attention to cases where the error associated to each fault is a Pauli 
operator. A slight generalization of Theorem [2] will allow us to consider other sorts 
of errors by looking at linear combinations of diagrams with specific Pauli errors. 
If I draw a similar diagram but with thin lines and no indication of the number 
of errors, that means the diagram represents an idealized unencoded version of the 
same operation. 

Now we can say rigorously what it means for these gadgets to be fault tolerant. 
The following definitions will involve t, the number of errors the code can correct, 
and the ideal decoder for the code. We only need to guarantee the behavior of the 
system when the total number of errors involved is less than <, since we expect the 
constructions to fail no matter what we do when there arc more errors than the 
code can correct. 

Definition 2 (Fault- Tolerant Measurement). A measurement gadget is fault 
tolerant if it satisfies the following property: 

Meas: ~[]~[) = ~W — [/' [) when r + s<t. 

That is, if the total number of errors in the incoming state and measurement 
gadget is at most t, then we should get the same result out of the real gadget as 
if we had performed ideal decoding on the incoming state and measured the de- 
coded qubit. By "the same result," I mean not only that the various measurement 
outcomes have the same probability in both cases, but that the remainder of the 
computer is left in the same relative state, conditioned on the measurement out- 
come, for either diagram. Really, we are comparing two operations, each of which 
transforms a quantum state of the whole computer into a quantum state for the 
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computer minus one encoded block, plus a classical measurement outcome. The 
two operations are the same when the measurement gadget is fault tolerant. 

Definition 3 (Fault-Tolerant Preparation). A preparation gadget is fault tol- 
erant if it satisfies the following two properties: 

Prep A: (^J — = (^j — jj — when s <t. 

Prep B: (] = Q— when s<t. 

That is, a fault-tolerant preparation step with s < t errors should output a 
state that is within s errors of a properly encoded state, and that furthermore, 
the state should decode to the correct state under an ideal decodc^r. In the above 
diagram equation for Prep A, and in many of the equations below, when we have 
a fault-tolerant gadget on both the left and right side of the equation, assume the 
faults on both sides are in the same locations and of the same type. 

The definitions for a fault- tolerant gate are slightly more complicated, but of 
much the same form: 

Definition 4. A gate gadget is fault tolerant if it satisfies the following two 
properties: 



when s + J2in <t- 



GateB: -[P~®MV = ~[F~^^£^ whens + E,n<i. 

In all of these diagrams, a separate filter is applied to each input block when 
U is a multiple-qubit gate. Input block i gets an ri-filter. In property Gate A, a 
separate filter is applied to each output block, but in all cases it is an s+J2i ''i-filter. 
In property Gate B, an ideal decoder is applied separately to each block. 

Property Gate A says that errors should not propagate too badly: it is OK (and 

unavoidable) for errors to propagate from one block to another, but they should not 
spread within a block. Thus, the final number of errors on the outgoing state of each 
block should be no more than the total number of errors on the incoming states, 
plus the number of errors that occurred during the gate gadget. As before, this only 
needs to apply when the total number of errors is less than t. Property Gate B says 
that if there are not too many errors in the incoming blocks and gadget combined, 
then the fault-tolerant gate gadget should perform the right encoded gate. Gate B 
almost says that we can create a commutative diagram with the ideal decoder, the 
FT gate gadget, and the unencoded ideal gate gadget, but the commutation only 
need hold when the incoming states have few total errors. 
Finally, we must define fault-tolerant error correction: 

Definition 5. An error correction (EC) gadget is fault tolerant if it satisfies 
the following two properties: 



EC A: 



I s I I s n s 

— EC — = — EC — \V- 



when s < t. 
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EC B: 



when 



s <t. 



That is, after an error correction step with at most s faulty locations, the state 
is at most s errors away from some encoded state. Note that this must apply no 
matter how many errors were in the incoming state. This does not necessarily mean 
those errors were dealt with properly, only that the final state is near a codeword. 
It might be the wrong codeword, but it is still a valid codeword. Property EC B 
does say that if the total number of incoming errors and errors during the FT EC 
step is less than t, the state has been corrected, in the sense that the logical state 
after the EC step is the same as the logical state before it. 



4.3. Transversal gates. Now we must try to find constructions that fulfill 
these definitions. Let us start with gate gadgets. Indeed, we have already seen a 
construction of fault-tolerant gates: Recall that for an [[n, k, d]] stabilizer code with 
stabilizer S, N{S)/S = Vk, the logical Pauli group on the k encoded qubits. Thus, 
in the absence of any errors, we can perform a logical Z , for instance, by choosing 
a representative Q of the appropriate coset in N{S)/S. Q G Vn, so to perform it, 
we simply need to perform some Pauli matrix (or the identity) on each of the n 
physical qubits in the code. Observe that this construction satisfies properties Gate 
A and Gate B: Since we are performing single-qubit gates, there is no opportunity 
for errors to propagate to different qubits, so property Gate A is clearly satisfied 
for any number of errors (even if it is greater than t) . Property Gate B follows from 
this fact as well (although in this case, we really do need to specify that the number 
of errors is at most t). If you want to prove more formally that these properties are 
satisfied, the key step is to note that we can rearrange the errors to all come after 
the logical gate. Moving errors through the Pauli operator Q may change their 
identity — we conjugate by Q — but does not change their weight. 

Of course, the reason this is true is that Q is a tensor product of single-qubit 
gates. For many codes, we can find additional gates that can be performed this way. 
For instance, for the 7-qubit code, you can check that performing the Hadamard 
on all 7 qubits, 7?®^, performs the logical Hadamard H. This construction of 
H is automatically fault-tolerant, again because conjugating an error by H does 
not change the weight of the error. Similarly, for the 7-qubit code, one can fault- 
tolerantly perform P (the 7r/4 rotation) by performing on each of the 7 physical 
qubits in the code |44j . 

If we wish to generalize to niultiple-qubit gates — and we need to do that 
somehow to get universal quantum computation — we can no longer assume that 
conjugating by U will leave the weight of an error unchanged. However, if we 
make sure that any increase in the number of errors is spread out between multiple 
blocks of the code, we can ensure that each block is not overwhelmed with errors. 
In particular, suppose we consider a gate (which may act on m blocks of the code) 
which is constructed as a tensor product U — ^Ui, where Ui acts on the ith qubit 
of each block. The UiS can do whatever they like to the m qubits they act on; we 
don't even make the constraint that all the UiS be the same. A gate constructed 
this way is called a transversal gate, and it will automatically be fault tolerant. 
When Ui conjugates any number of errors on the m ith qubits, we can get an error 
that acts only on those m qubits. In particular, Ui will only ever propagate a single 
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error into at most one qubit per block. Therefore, properties Gate A and Gate B 
will also hold for transversal gates. 

Note that we insist in the definition of transversal that the ith qubit of one 
block only interacts with the ith qubit of another block, and not some different 
qubit in the second block. If this were not true, the gate would still be fault tolerant 
provided each qubit in one block interacted with only a single qubit in a different 
block. However, such a construction could cause problems if we attempted to put 
two of them together. For instance, if we have a gate that interacts qubit i of block 
1 with qubit j ^ i oi block 2, and then follow it by a traditional transversal gate, 
an initial error on qubit i of block 1 could propagate to qubit j of block 2 and then 
back to qubit j of block 1, leaving us with two errors in the first block. The product 
of two transversal gates is again transversal, and thus fault-tolerant, but this would 
not be true if we changed the definition of transversal to allow permutations of the 
qubits in a block. 

As an example of a transversal two-qubit gate, consider again the 7-qubit code. 
Performing CNOT®^ — a transversal CNOT between corresponding qubits of the 
two blocks — implements the logical CNOT [44] . We sometimes use the terminol- 
ogy "transversal t7" for the transversal gate t/®". Even though transversal does not 
necessarily mean that all the tensor components are the same, the most common 
examples have this property, so the phrase is often used as a shorthand. 

In fact, the transversal CNOT performs the logical CNOT for any CSS code, 
not just the 7-qubit code. This fact is one reason that CSS codes are particularly 
favorable for fault tolerance. (We shall see another in the following section.) The 
7-qubit code is particularly good. As I noted above, for the 7-qubit code, we have 
transversal implementations of P, and CNOT. Since products of transversal 
gates are again transversal, this implies that the whole logical Clifford group can 
be implemented transversally as well. However, the Clifford group is not universal 
for quantum computation (it can even be efficiently simulated classically), and 
unfortunately, there are no other transversal logical gates for the 7-qubit code, so 
we will have to resort to another type of construction to complete a universal set 
of logical gates. One might hope to avoid this by finding a better code, but in fact, 
no code allows a universal set of transversal gates [I8j . 

4.4. Fault-tolerant error correction and measurement. We will return 
to the task of completing the universal set of logical gates in a little bit, but first let 
us discuss another part of a fault-tolerant protocol, fault-tolerant error correction. 
Before we do that, we should first consider precisely how we do non- fault-tolerant 
error correction. 

When we have an [[n, fc, d]] stabilizer code, to do error correction, we wish to 
measure the eigenvalue of each of the n — k generators of the stabilizer. Each 
eigenvalue tells us one bit of the error syndrome. It is straightforward to measure 
the eigenvalue of any unitary operator U using a standard phase kickback trick 
(see figure [T]). Add a single ancilla qubit in the state |0) -|- |1), and perform the 
controlled-t7 from the ancilla qubit to the data for which we wish to measure U. 
Then if the data is in an eigenstate of U with eigenvalue e*"^ , the ancilla will remain 
unentangled with the data, but is now in the state |0) -I- e^'^\l). (If the data is not 
in an eigenstate, than the ancilla becomes entangled with it, decohering the data in 
the eigenbasis of C/.) In the case where the eigenvalues of U are ±1, as for t7 £Vn, 
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Figure 1. A non- fault-tolerant implementation of the measure- 
ment of U , which has eigenvalues ±1. 

we can just measure (p by performing a Hadamard transform on the ancilla qubit 
and measuring it. 

However, this construction allows for runaway error propagation, even when U 
is as simple as a multiple-qubit Pauli operator. The controUed-C/ is implemented 
as a series of controlled-Qi gates, with Qi G Vi acting on the ith data qubit, but 
each controlled-Qi gate is capable of propagating errors in cither direction between 
the ancilla qubit and the zth data qubit. Therefore, a single error early on in this 
construction could easily propagate to many qubits in the data block. 

To avoid this, we would like to spread out the ancilla qubit to make the 
controUed-C/ gate more like a transversal gate. However, we want either all the 
QiS to act or none of them. We can achieve this by using an ancilla in the n-qubit 
"cat" state |00 . . . 0) + |11 . . . 1), as in figured After interacting with the data, we 
would like to distinguish the states |00 . . . 0) ± |11 . . . 1). The most straightforward 
way to do this is to note that 

(68) ir®"(|00...0) + |ll...l)) = Yl 1^) 

wt(a:)— even 

(69) ff«"(|00...0)-|ll...l))= 1^)- 

wt(a:)— odd 

Thus, by measuring each qubit of the ancilla in the Hadamard basis and taking 
the parity, we can learn the eigenvalue of U . Now the ith qubit of the data only 
interacts with the ith qubit of the ancilla, so there is no chance of catastrophic error 
propagation. Errors can only propagate between a single qubit of the ancilla and 
a single qubit of the data. For simplicity, I described the cat state as an n-qubit 
state, but of course, it only need be as large as the weight of J7, since any additional 
qubits in the ancilla will not interact with the data at all. 

Still, this construction does not yet give us a fault-tolerant error correction 
gadget. There are two remaining problems. First, we have not specified how to 
create the ancilla cat state yet. Second, if even a single qubit of the ancilla has an 
error, the measurement result could have the wrong parity, giving us an incorrect 
syndrome bit. The solution to the second problem is tedious but straightforward: 
after measuring every bit of the error syndrome to get a candidate error syndrome, 
we repeat the process. If we repeat enough times, and the number of errors in the 
course of process is not too large, we can eventually be confident in the outcome, 
as a single faulty location can only cause a single measurement outcome to be 
incorrect. Actually, there are some additional complications due to the possibility 
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Figure 2 . A component of a fault-tolerant implementation of the 
measurement of C/ — ^Ui, which has eigenvalues ±1. 

of errors occurring in the data qubits — which can cause the true error syndrome 
to change — in the middle of the correction process, but these too can be handled 
by sufficient repetition of the measurement. 

To create a cat state, we must be somewhat careful. The obvious circuits to 
do it are not fault-tolerant. For instance, we could put a single qubit in the state 
|0) 4- and then perform CNOTs to the other n — 1 qubits, which are initially 
in the |0) state. However, an error halfway through this procedure could give us a 
state such as |0011) -I- |1100), which effectively has two bit flip errors on it. When 
we interact with the data as in figure [2l the two bit flip errors will propagate into 
the data block, resulting in a state with 2 errors in it. To avoid this, after creating 
the cat state, we must verify it. One way to do so is to take pairs of qubits from the 
cat state and CNOT them both to an additional ancilla qubit which is initialized to 
|0). Then we measure the additional ancilla, and if it is we know that the two 
qubits being tested are different, and we discard the cat state and try again. Even 
though this verification procedure is not transversal, it is still going to allow us to 
fault-tolerantly verify the state due the nature of error propagation in a CNOT. 
The ancilla qubit is the target of both CNOT operations, which means only phase 
errors can propagate from it into the cat state. A single phase error can already 
ruin our cat state, giving us the wrong syndrome bit as the outcome — that is why 
we must repeat the measurement — so two phase errors are no worse. If we do 
sufficient verification steps, we can be confident that either the ancilla cat state is 
correct, with possibly s errors on it, or there were more than s faulty locations in 
total during the preparation and verification step for the cat state. That is enough 
to ensure that the error correction procedure, taken as a whole, is fault tolerant. 

To summarize, we must first create many cat states. We do this via some 
non-fault-tolerant procedure followed by verifying pairs of qubits within the cat 
state to see if they are the same. We use each cat state to measure one bit of 
the error syndrome, and repeat the measurement of the full syndrome a number 
of times. In the end, we deduce a consensus error syndrome and from it an error 
which we believe occurred on the data, and then correct that error. The above 
procedure is known as Shor error correction [44) . and it works for any stabilizer 
code. A similar procedure can be used for measuring a logical Pauli operation on a 
stabilizer code, although in that case, we must be careful to perform error correction 
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before repeating our measurement attempt, as an uncorrected error on the data can 
cause the measurement outcome to be incorrect even if the measurement procedure 
itself is completely free of errors. I have been somewhat cavalier about some of the 
details above partially because they are complicated and partly because Shor error 
correction is rather laborious, requiring many extra gates and a low physical error 
rate to work well. There are some much more efficient schemes for fault-tolerant 
error correction available, so Shor error correction is rarely used. 

The first such improved scheme is Steane error correction ^48j. Steane error 
correction works only on CSS codes. (There is a more complicated version that 
works on general stabilizer codes, but it is not usually used; the version in Steane's 
paper has an error.) Recall that the codewords of a CSS code are of the form 
J2w£C^ |u + w) where C2 is a classical linear code, and u S Ci. u tells us the 
logical codeword encoded by this state. If we were to measure every qubit of a 
CSS code, in the absence of error, we would get the classical result u + wior some 
random w S C^. Since C Ci, u + w G Ci, but we can deduce u by seeing which 
coset from Ci/C^ u+w falls into. If there are some errors on the state, phase errors 
in the original state do not cause errors in the measurement outcome; however, a 
bit flip error on qubit i produces a bit flip error on the corresponding classical bit 
i. Thus the classical outcome is u + w + e, where e is a vector representing the 
locations of the errors. But Ci is a classical error-correcting code, so by applying 
the classical decoding procedure, we can deduce e, u, and w if there are not too 
many errors. 

If there are some faults in the physical measurement locations, then the out- 
come becomes u + w -\- e + f , where e represents the pre-existing bit flip errors 
before the measurement and / represents the errors caused by faulty measurement 
locations. Note, however, that measurement is performed transversally, so a single 
failed measurement only affects a single bit of the output; that is, wt(/) < s when 
there are s faulty measurement locations. In this case, provided wt(e + f) < ti 
(assume the classical code C'l corrects ti errors), we can deduce u, w, and e + f; 
however, we cannot distinguish e and /. This is annoying, but not particularly 
harmful if we only wish to measure the state. In that case, u tells us the outcome 
of the measurement, and as long as we learn that, we are OK. This gives us a 
fault-tolerant measurement procedure for CSS codes. 

Of course, we have not achieved fault-tolerant error correction yet. Measuring 
the qubits directly does tell us about bit flip errors, but only at the cost of destroying 
the code block. Clearly that is not desirable. We will also need to learn about any 
phase flip errors in the state. To do so, we will again introduce some ancilla qubits. 
I noted above that transversal CNOT applies the logical CNOT for any CSS code. 
Therefore, let us create an ancilla block in a codeword of the CSS code we are using. 
Then do a transversal CNOT from the data block to the ancilla block. Afterwards, 
both the data block and the ancilla block are still in codeword states. Furthermore, 
any bit flip errors in the data were propagated forward along the CNOTs to the 
corresponding locations in the ancilla block. Now if we measure every qubit of 
the ancilla block, as described above, we learn e + / for the ancilla block. That 
will be a combination of the bit flip errors on the data block, pre-existing bit flip 
errors on the ancilla, and bit flip errors that occurred during transversal CNOT or 
measurement. There are clearly a lot of extraneous errors to worry about, but at 
least we have learned something about the errors in the data block. 
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Figure 3. Steane Error Correction. Each horizontal hne repre- 
sents a full n-qubit block of the code, and each gate or measurement 
represents a transversal implementation of that operation. 



Still, we need to be careful. We used a transversal CNOT to copy the errors 
from the data block to the ancilla, but we don't actually want to perform the logical 
CNOT gate. Error correction should leave the encoded data unchanged. Therefore, 
we should start the ancilla not in just any codeword state, but in the encoded state 
|0) + |T), an eigenstate of CNOT (when it is in the target block of the CNOT). 
Thus, the encoded state of the data does not change when we perform the CNOT. 
This also means that measuring u for the ancilla tells us nothing about the state of 
the encoded data; indeed, u will be random, just like w. We have to also be careful 
about error propagation: while bit flip errors are propagating from the data block 
into the ancilla block, phase errors are propagating from the ancilla block into the 
data block. Therefore, we must be careful that the procedure we use to create the 
ancilla block does not result in too many errors. Since the ancilla block is just 
an encoded |0) + |1) state, the problem of creating such a state is identical to the 
problem of creating a fault-tolerant preparation gadget, so I will defer discussion of 
how to do this until section l4!6l For now, just assume that we have such a method 
which, when the encoding circuit has at most s faulty locations, creates the correct 
state with at most s errors on it. 

To correct bit flip errors on a CSS code, we thus create an ancilla encoded in 
the same code in the state |0) -I- and perform transversal CNOT from the data 
block to the code block. Then we measure all of the qubits of the ancilla block, and 
treat the result as a classical codeword for the code Ci. We deduce the locations 
of the errors, and correct them in the data block. We can follow almost the same 
procedure to correct phase errors: Instead, we create an ancilla block in the state 
|0) and perform transversal CNOT with the ancilla block as control and the data 
block as target. This copies phase errors from the data block to the ancilla, and 
so we measure each ancilla qubit in the Hadamard-rotated basis. In that basis, the 
code is a superposition of codewords from C2 , so we treat the measurement output 
as a classical codeword for C2 with some errors, and deduce those errors via the 
classical decoding procedure for C2. Then we correct phase errors in the resulting 
locations in the data block. The whole procedure is summarized in figure [31 

Now let us show that Steane EC satisfies properties EC A and EC B. Assume 
that the incoming data block has errors in locations summarized by a vector e, with 
e composed of ep, phase errors, and es, bit flip errors. In each of these vectors, 
1 in the ith component of the vector indicates an error acting on the ith qubit of 
the block, ep and cb can have Is in the same location, in which case there is a 
Y error at that location. We can assume that all errors in the incoming block are 
Pauli errors by linearity (a la Theorem [2]) . 
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Suppose the phase ancilla, after its preparation is complete, has errors whose 
locations can be summarized by a binary vector fp, and the bit flip ancilla has 
errors that can be summarized by a binary vector Jb- Let us summarize the 
faults in CNOT gate locations hy gp and gp- (Note that each such faulty gate 
location can affect both the corresponding data qubit and ancilla qubit, and not 
necessarily with the same sort of error.) Finally, assume that during the Hadamard 
and measurement of the phase ancilla block, there are faults whose locations are 
summarized together by a vector hp, and during the measurement of the bit flip 
ancilla block, there are faults summarized hy hp- For hp and hp, we will only 
count errors that show up in the measurement result, since there is no possibility 
of these errors propagating into the data block except via the measurement result. 
For the other sorts of errors (other than those in the incoming data block), we will 
make no restrictions as to the types of errors. We will ignore errors that occur 
during the final correction step where we fix the error deduced from the syndrome 
measurement, since the correction step itself can be done transversally. Errors that 
occur then count, of course, but each error during the final correction step can only 
cause one qubit to go wrong, so they can never cause EC A or EC B to fail. 

To prove EC A, we assume that s = wt(/p) + wt(/B) + wt{gp) + wt{gB) + 
wt{hp) + wt{hB) < t, and we wish to show that the final state after correcting the 
measured error is at most s errors away from a valid codeword of some sort. In 
fact, I claim the following: 

Claim 1. The final state will have errors only on qubits from fp\/ fp \/ gp\/ 
gpV hpV hp, where V represents the bitwise OR. 

That is, the only qubits in the final state that have errors will be in a location 
corresponding to one of the faults that occurred during the EC circuit, and there 
are at most s of those. By "corresponding location," I mean that if a fault occurs 
in the ith qubit of one of the ancilla blocks, there could be a fault in the ith qubit 
of the data block. 

Proof. In the following proof, the fx \ gx \ and hx^ {x = P, B) will be vectors 

which indicate subsets of /x, .gx, and h^- The content of the (i) superscripts has no 
particular meaning except to label potentially different subsets. 

The error measured by the phase part of the error correction will be ep + /p ^ + 
+ h^P . However, note that, since we are making no restriction on wt(ep), it is 
possible that wt(ep + /p ' + g^ + h^) > t2, where the phase code C2 corrects t2 
errors. In that case, the classical decoding procedure for C2 will instead deduce some 
error d which might be different from the actual accumulated error. Still, d must 
have the same syndrome as ep+/p''+gp''+/ip-' , sou = d+ep+ fp^ +g''p' +hP G C2. 
Since the X generators of the CSS code are given by vectors of C^, it follows that 
the operator Zy with Zs on all the qubits indicated by u e C2 commutes with 
every X generator, and therefore Zy E N{S), and it maps any logical codeword to 
another (potentially different) logical codeword. 

After interacting with the two ancilla blocks, but before we correct any errors, 

(2) (2) (2) 

the data will have phase errors on qubits indicated by the set ep + g p + g^ + fg . 
When we apply phase error correction to fix the errors on the qubits indicated 

(2) (2) (2) 

by d, we therefore get the net phase error d + ep + gp + gp + fp ■ Now, we 
know that d + ep = v + fp^ + gp^ + hp\ so we can rewrite the net phase error 
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Figure 4. Knill EC. Each horizontal line represents a full n-qubit 
block of the code, and each gate or measurement represents a 
transversal implementation of that operation. Q is & Pauli oper- 
ator and contains a correction for both the teleportation outcome 
and error correction. 

as w + f'^p'^ + /l^^ + g'^p' + g^p' + 5^^' + h'-p' . But e N{S), so applying a phase 
to all the qubits of v only takes us to another codeword. Therefore, the final state, 
post-error correction, is equal to some codeword with a phase error fp^ + fp^ + 
g^P^ + 9p^ +9b^ + h^p (plus possibly some bit flip errors). Note that this is a subset 
of fpVfB'^gp'^gB'^hpyhB, showing that the phase errors on the final codeword 
satisfy the claim. 

The proof that the final bit flip errors are a subset of /p V/s Vyp V gs V/ip V/is 
is similar. □ 

Proving the property EC B is more straightforward, since we can now assume 
that s + wt(e) < t. Again, the final errors will be a subset of fpWfsW gp V gs V 
hpV Hb, but now there is no shift by an element of N{S), so an ideal decoder after 
the EC step will produce the same result as an ideal decoder applied before the EC 
step, when there is just the error e. 

Another useful method of fault-tolerant error correction is due to Knill [30) . 
Knill error correction is at some level similar to Steane error correction, in that 
it uses an ancilla state which is encoded using the same code as the data block. 
However, Knill EC works for any stabilizer code. The basic idea is to perform 
quantum teleportation, moving the encoded state into a different block of the code. 
Because of the encoding, the Bell measurement used in quantum teleportation gains 
more information than is needed for teleportation, and the extra information tells 
us the error syndrome of the combined errors on the data and ancilla block. Knill 
error correction is pictured in figure ID Two blocks are measured in the course of 
teleportation. One is basically used to reconstruct the Xs in the stabilizer and 
one to reconstruct the Zs. I will not go into the details of how Knill EC works 
here — see [30] instead. Knill EC can easily be modified to allow fault-tolerant 
measurement as well. To do that, we substitute an ancilla in the state |0) for the 
encoded EPR pair in the error correction circuit. The encoded Bell measurement 
then still tells us the error syndrome, but instead of two random classical bits for 
the teleportation, it tells us the outcome of a logical measurement on the data block 
in the standard basis. 

Steane and Knill EC both work on the principle of moving as much work as 
possible in the EC step into the creation of a particular ancilla state. There are two 
advantages to doing so [301 1391 148| . First, it means we do not have to do much 
work directly on the data, which means the qubits don't have to sit around waiting 
for the EC step to finish and don't accumulate much additional error during that 
time. Second, because the ancillas are created in known states, we can put a lot of 
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Figure 5. Gate teleportation of U. The process of teleporting the 
state followed by U is the same as teleporting the state through a 
special ancilla with an appropriately modified correction operation. 



effort into verifying that they are correct, which we could not do directly for the 
unknown data state. 



4.5. Gate teleportation and universal fault-tolerant quantum compu- 
tation. Now let us return to the task of creating a universal set of fault-tolerant 
gates. Since it is not possible to do this transversally, we need to add a new compo- 
nent, and that component will be measurement. The basic strategy will be similar 
to that for Stcane or Knill EC: we will put a lot of effort into creating an appro- 
priate ancilla state, and then quickly interact it with the data, the result being an 
implementation of some particular gate. Not every gate can be directly performed 
this way, but some non-Clifford group gates can be, and combined with the Clifford 
group gates, that is enough to give us a universal set of quantum gates. 

The construction can be described in terms of quantum teleportation, again on 
the encoded states. Let us begin by not worrying about fault-tolerance, and simply 
attempt to perform some gate U on an encoded state. We will consider the case of 
a single-qubit gate U first. Suppose we were to perform quantum teleportation and 
then follow it, somehow, by an implementation of U. Then on input state the 
overall output state would of course be C/jf/;)- Now imagine that Bob, who controls 
the output block, gets impatient waiting for Alice's measurement outcome and 
decides to perform U earlier than intended. Eventually Alice performs the logical 
Bell measurement and sends Bob the two classical bits describing the outcome, 
corresponding to a logical Pauli Q. To complete the teleportation procedure. Bob 
now needs to do something slightly different than before: First, he must undo the 
U he performed prematurely, then perform Q, and then finally redo U, now in the 
correct place. That is, he should do the gate UQU^ . This procedure is pictured in 
figure O It may not seem like we have gained anything by doing this, but for some 
special gates U , we have. We can imagine the state {I ® C/)(|00) -I- |Tl)) as a special 
ancilla state, a replacement for the EPR pair normally used in teleportation, and 
we can prepare it separately. Since it is a fixed ancilla state, independent of the 
data, we can apply some special tricks to preparing it. 

We still have to perform the gate UQU\ which cannot be done ahead of time 
on the ancilla, since Q depends on the outcome of a logical Bell measurement on 
the data block. However, the gate UQU'^ might be simpler to perform than U was. 
For instance, when U & Ci, UQW € Vi — that is the defining property of the 
Clifford group. For some gates ^ Ci, it is nonetheless still true that UQU^ £ Ci 
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for any Q ^ Vi. For instance, the 7r/8 rotation i?Tr/8 has this property: 

(70) R^/^XRl,^ ^ j = 

(71) ^^8^4/8 = Z 

We sometimes cah the set of unitary operators with this property, of conjugating 
Pauh operators into Chfford group operators, C3. Ci is the Pauh group 7^„, and C2 
is the Chfford group Ci0 One can define a set Ck = {U\UQW € Ck-i VQ e Ci}, 
and the teleportation construction tells us how, given appropriate ancilla states, to 
perform a gate from Ck once we know how to perform gates from Ck-i- Note that 
the sets Ck are not closed under multiplication. 

This gives us an indication of how to perform a universal set of fault-tolerant 
gates. For the 7-qubit code, and some similar CSS codes, we already know how to 
perform all logical Clifford group operations. The Bell measurement is a Clifford 
group operation (plus measurement, which we also know how to do fault-tolerantly), 
and now we have seen that R-^/nQRl/g, is also a Clifford group operation for Q E V. 

Thus, if we can just prepare the special ancilla state (/ (g) i?7r/8)(|00) -I- |11)) fault- 
tolerantly, we can do the complete gate teleportation procedure for the 7-qubit code 
to implement a fault-tolerant iJ^r/s gate. Since the Clifford group plus Rt^/s form a 
universal set of gates, that gives us a universal fault-tolerant gate set for the 7-qubit 
code. 

It is perhaps worth saying as an aside a few words about the nature of this 
universal set of gates. Note that for a fixed number of (logical) qubits, it contains a 
finite set of gates. These gates do not commute with each other, and if we look at 
the group generated by these gates, we find that it is an infinite group. However, 
the unitary group is uncountable, so we will not be able to exactly implement all 
unitary gates. We can, however, get arbitrarily close to any gate we wish, and 
the approximation procedure can be done quite efficiently as a consequence of the 
Solovay-Kitaev theorem [27L 145] . For any gate U, to approximate U to within a 
distance e, we need only use polylog(l/e) gates. 

Now back to fault tolerance. I have described the construction above for single- 
qubit gates U, but that is in no way essential. For a multiple-qubit gate U, we simply 
need, as an ancilla, a state composed of multiple encoded EPR pairs with U applied 
jointly on the second half of all of them. For instance, we can perform the CNOT in 
this way using a four-qubit ancilla. If we take any stabilizer code with stabilizer S, 
we can perform the Bell measurement as part of Knill error correction, and N(S) 
gives us transversal implementations of the logical Pauli group. Thus, using gate 
teleportation, given an appropriate ancilla, we get a fault-tolerant implementation 
for any Clifford group gate on S. Then we can use gate teleportation again to 
get a universal set of gates. Thus, we can perform a universal set of gates for any 
stabilizer code |21| . 

For certain gates, even simpler constructions are available that take advantage 
of special properties of the gate [9l \44\ 155). For instance, R^r/s is a diagonal gate, 
and that lets us use the construction in figure [6l The more efficient construction 
only involves a single encoded block as ancilla, which is somewhat easier to create. 



I apologize for the similar appearance of Cn and C^. Cic will not appear outside this 
paragraph. 
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Figure 6. More cfBcicnt gate teleportation of R-j^/s- The CNOT 
represents a logical CNOT, perhaps performed transversally. 



4.6. Fault-tolerant state preparation. The constructions I have presented 
in the last few sections rely on the ability to fault-tolerantly prepare some particular 
states. It may seem like we have just postponed the main difficulty in performing 
non-Clifford group gates and fault-tolerant error correction, and to a certain extent 
this is true. However, since the ancillas we use in the above procedures are being 
prepared in known states, we have more options as to how to create them than 
we do for performing an operation (such as the n/S rotation) on an unknown data 
state. 

In order to perform Steane or Knill EC, we need to know how to create encoded 
|0) and encoded |0) + |1) states with few errors in them. We also, of course, need 
encoded |0) states to initialize the fault- tolerant quantum computation. Our goal, 
in particular, is to avoid correlated errors in these states. The desired states can 
easily be created using some non- fault-tolerant encoding circuit, but because such 
circuits inevitably involve gates interacting pairs of qubits within the code block 
we are constructing, a single error during the encoding circuit can cause correlated 
errors affecting multiple qubits in the new block. This would certainly fail to satisfy 
property Prep A, and could easily fail to satisfy Prep B as well. 

One way to create states is to use a version of Shor error correction. If we add 
a stabilizer generator corresponding to the Z (for |0)) or X (for |0) + then 
there is just a single state in the code specified by the new stabilizer, and it is the 
one we wish to create. Performing Shor EC to correct an arbitrary state to the one 
codeword of this new code will then produce a fault-tolerant preparation gadget. 

Steane and Knill EC don't give us so immediately methods of state preparation 
since they need themselves ancillas prepared for the state we are trying to create, 
but they still point us in the right direction. Suppose we performed Steane EC 
on the created state without first verifying the ancilla states. The result would 
not be reliable, since the states involved could have multiple correlated errors due 
to only a single error in the encoding circuit. However, suppose that if instead 
of correcting the state based on the error syndrome we measure, we simply use 
the procedure to detect whether errors are present. Then if we see any errors, we 
discard the main state we are trying to create as well as the measured ancillas. In 
order for a correlated error to slip past this procedure, we need correlated errors 
both on the data block we are trying to verify and on one or both ancilla blocks, and 
furthermore, those errors must cancel in the error syndrome. Since the data block 
and ancilla blocks are created separately, we need two separate faults for this to 
be possible: one during the creation of the data block and one during the creation 
of the ancilla block. We may need to repeat this procedure using ancillas that 
themselves have passed previous rounds of screening, but with a sufficient number 
of iterations, we can fault-tolerantly prepare states even for large distance codes. 
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For gate teleportation, we need more complicated ancillas. I will not go into 
the details, but simply mention some of the main methods used in preparing such 
states. For the ancillas needed to teleport Clifford group gates, we can use the 
method based on Shor EC or similar verification procedures to those for |0) or 
|0) + We have the same two options for other gates such as i?7r/8; but both 
methods become more complicated. The ancilla states used for i?^/8 and similar 
gates are eigenstates of Clifford group operators, and can be uniquely specified by 
this fact. For instance, the state |0) + e*^/^|f) is the unique codeword which is a +1 
eigenstate of e"/''XPt. Thus, if we measure the eigenvalues of XP^ ^ which we can 
do using a Shor-like method involving a cat state and repetition, we can determine 
if the ancilla state is correct or not |44) . 

There is also a method for verifying this state and some other related ancilla 
states which involves comparing a number of copies of the state to test if any have 
errors on them. As before, we imagine using some non-fault-tolerant procedure to 
create candidate ancilla states, and then we put them through this verification pro- 
cedure and discard any states that fail. The states that come out of the procedure 
are more likely to be error-free (or at least less likely to have errors dating from 
the non- fault-tolerant encoding part of the protocol). We can then take a pool 
of previously-tested states and iterate the verification procedure to purify them 
further. For details, see |10l . 

5. Fault-tolerant circuits and the threshold theorem 

5.1. Good and bad extended rectangles. We have finally shown that there 
exist gadgets for fault-tolerant state preparation, measurement, error correction, 
and a universal set of gates. Now we are ready to study what happens when 
we apply these gadgets. I will first show that provided errors do not occur too 
frequently, we can put together a sequence of fault-tolerant gadgets to create a 
circuit that gives the same output as the ideal unencoded circuit. 

Definition 6. Let C be a quantum circuit consisting of a set of locations C^, 
where each Ci is a preparation location, a measurement location, a gate location, or 
a wait location. The preparation locations introduce new qubits into the circuit, and 
the measurement locations remove qubits from the circuit. We assume that C can 
be divided up into time steps so that at each time step, every qubit (not counting 
those to be added at later time steps or removed at earlier time steps) is involved 
in exactly one location, that the first location for every qubit is a preparation 
location, and that the last location for every qubit is a measurement. Two locations 
are considered to be consecutive if they occur at adjacent time steps and they 
share a qubit. (If both are two-qubit gates, they only need to share one qubit.) 
The fault-tolerant protocol for C (using a particular [[n, 1,2< -I- 1]] QECC) is a 
quantum circuit C" constructed by replacing each location Ci with a fault-tolerant 
gadget for Ci, and adding fault-tolerant error correction gadgets between any pair 
of consecutive locations. C is referred to as a fault-tolerant circuit for C or a 
fault-tolerant simulation of C . 

However, it is a bit unwieldy to prove things directly about the circuit as a 
whole. Therefore, it makes more sense to focus on smaller units. We will chop 
the fault-tolerant circuit up into pieces that contain just a single location from the 
original circuit C: 
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Figure 7. A schematic representation of a sample fault-tolerant 
protocol, with extended rectangles marked. 



Definition 7. An extended rectangle (abbreviated ExRec) in the fault-tolerant 
circuit for C consists of the fault-tolerant gadget corresponding to some location Ci 
for the original circuit, plus all of the fault-tolerant EC gadgets between Ci and the 
adjacent locations. We can characterize an ExRec by the type of the location Ci 
— e.g., if Ci is a preparation location, then the corresponding extended rectangle 
is a preparation ExRec. The EC step(s) before the gadget for Ci are leading EC 
step(s), and those after the gadget for d are trailing EC step(s). 

Figure [7] gives an example of a fault-tolerant circuit, with the ExRecs indicated 
by dashed lines. Note that a preparation ExRec or a measurement ExRec only 
contains a single EC, while a gate (or wait) ExRec contains two EC steps for each 
qubit involved in the gate. Except for a preparation ExRec, all ExRecs start with 
EC steps. Also, adjacent extended rectangles overlap. This is a complication, 
but is actually simpler to deal with than the alternative of having non-overlapping 
rectangles. This is because we would like to somehow capture a notion that a 
rectangle "behaves correctly" when it does not have too many faulty locations. 
However, if the rectangles do not overlap, there could be an accumulation of errors 
at the end of one rectangle and at the beginning of the subsequent rectangle. There 
is no time to correct any errors between the two rectangles, so those errors would 
combine to produce more errors than one might naively expect just counting faulty 
locations in one rectangle. This can be dealt with, of course, but that means not 
only that analyzing the behavior of a single rectangle depends on the behavior of 
the previous rectangle, but also that we are not taking full advantage of the QECC's 
ability to correct errors. 

So what does it mean to say that an extended rectangle behaves correctly? It 
should mean, roughly speaking, that the encoded state after the extended rectangle 
is the same as encoded state before the extended rectangle but with the appropriate 
logical operation performed on the state. However, we still have the complication 
about having a collection of errors just before the beginning of an ExRec and 
then more just after the beginning. That could mean that the state just before 
the beginning of the ExRec is correctable, but then after the first time step of 
the ExRec, before error correction has really had a chance to act, it is no longer 
correctable. Instead of looking at the state before the beginning of the ExRec, 
we should instead look at the state after the leading EC step(s) of the ExRec but 
before the main gadget for the location d. By that point, any errors from the 
previous rectangle have either been corrected or at least combined with errors that 
occurred during the leading EC steps. Thus, we make the following definitions: 
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Definition 8. A gate or wait ExRec is correct for some particular arrange- 
ments of faults if 
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A preparation ExRec is correct for some particular arrangements of faults if 
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A measurement ExRec is correct for some particular arrangement of faults if 



(74) 



We expect that an ExRec should be correct if it contains no more errors than 
the code can correct. Thus, we make the following definition: 

Definition 9. A full ExRec is good if it contains at most t faults, where the 
QECC in use corrects t errors. A full ExRec is bad if it is not good. 

The caveat "full ExRec" is needed for a technical reason which I will explain 
later. For now, ignore it. 

The definition of good is justified by the following theorem: 

Theorem 6 (Good implies correct). A good ExRec is correct. 

Proof. The proof is a fairly straightforward application of the definitions of 
fault-tolerant gadgets. I will present the case of a gate ExRec. Measurement 
and preparation ExRecs work similarly. Since the ExRec is good, in the following 
diagrams, Si + S2 + ss < t. 




36 



DANIEL GOTTESMAN 



(78) = -EC 



U )-—\ >— by Gate A 



(79) 
(80) 



- EC ^^{p^j^ (u^- by Gate B 





SI 


EC 





U y- by EC A 

□ 



5.2. Level reduction. Now let us consider tlie case of a complete fault- 
tolerant circuit. Suppose all the extended rectangles in the circuit are good. Then 
by applying theorem [H] repeatedly, we can create ideal decoders using the correct- 
ness property for the measurement locations, push the ideal decoders all the way 
to the left using correctness for the gate and wait locations, and then eliminate 
the ideal decoders using correctness for the preparation locations. We are left, as 
desired, with the original circuit C which the fault-tolerant circuit is supposed to 
simulate. 

Theorem 7. Suppose a fault-tolerant circuit for C contains only good extended 
rectangles. Then the output distribution of the fault-tolerant protocol is the same 
as the output distribution of C. 

That's precisely the result we wanted, but unfortunately it only applies when 
all the extended rectangles are good. In a little bit, once we talk more concretely 
about the model of errors, you will see that this result is enough to say that a fault- 
tolerant protocol helps protect against errors, in that, for sufficiently low error rate, 
the probability of having only good ExRecs in the complete fault-tolerant circuit is 
greater than the probability of getting through the original circuit C without any 
errors. Unfortunately, when C is large, it is still unlikely we can make it all the 
way through even a fault-tolerant circuit without having a bad extended rectangle 
unless we go to codes which can correct many errors. But if we do use codes with 
large we will need a special family of codes, since otherwise we have no good way 
to make the large ancillas we need for fault-tolerant gate constructions and fault- 
tolerant error correction. Luckily, there are two known families of codes for which 
we can solve this problem, giving a threshold theorem. One of them is based on 
topological constructions |16j . I will consider the other, which is somewhat simpler 
to analyze: the family of concatenated codes. 

The logic behind a concatenated code is quite straightforward. We have shown 
(up to a question of defining the right error model) that we can take any circuit 
C and create a fault-tolerant circuit C" that gives the same result and is more 
reliable than C. Why not, therefore, take C and create a fault-tolerant circuit 
C" simulating it? Surely that should be even more reliable. And if that is not 
enough, we can do it again and again until the circuit is robust enough to give 
us the right answer, even if the original circuit C is very large. And indeed, this 
strategy works. We can create a sequence of circuits C^*''-' , k = 1, . . . , L, where each 
is a fault-tolerant simulation of C'*^ , with (7^°) = C. When C is large, it is 
not very likely that C^^^ contains only good extended rectangles, but it will be true 
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that it simulates a C*-^^^^ which contains (with high probabihty, when the error 
rate is low enough, . . . ) fewer bad extended rectangles than C'-^\ and so on, until, 
with very high probability, C'"'^' does contain only good extended rectangles, and 
thus gives us a nearly perfect simulation of C. 

In order to prove this, however, we will need to understand what happens to 
a bad extended rectangle when we push an ideal decoder through it from right to 
left. We would like to say that a bad extended rectangle simulates a faulty location 
in the original circuit, and this is almost true. In particular, we would like for the 
following to be true when si + S2 + S3 > t, for some erroneous gate U': 



Unfortunately, we cannot easily make any such statement. The problem is that 
the error that occurs on the physical gate after the ideal decoder can depend not 
only on the faults in the gate gadget and trailing EC, but also on the faults in the 
leading EC and even the carryover error from the previous ExRec, so there is no 
way to define U' without looking at the larger context. To handle this problem, 
we introduce an alternate ideal decoder, a *-decoder, which keeps track of the error 
syndrome: 

-Decoder 

The line dropping out the bottom of the *-decoder contains the information about 
the error syndrome of the state input on the left. Consequently, the *-decoder is a 
unitary operation. To replace (|81[) . we thus can write: 

The erroneous gate U' uses the error syndrome as a control to tell it what sort of 
error to apply to the decoded qubit. Notice that we have pushed the *-decoder all 
the way through the ExRec, eliminating the leading EC as well as the gate gadget 
and trailing EC. This is needed so that bad ExRecs do not overlap, since that could 
produce correlated errors in the circuit being simulated. I shall return to this point 
shortly. 

Correctness is defined using *-decoders in a way that is essentially identical 
to using regular ideal decoders. The only difference is that we must account for 
what happens to the error syndrome. Even if we move a *-decoder through a 
gadget with no faults, the error syndrome produced will generally change to account 
for any gates performed on the erroneous physical qubits. For instance, if we 
perform a transversal Hadamard, pre-existing physical X errors will change to 
physical Z errors, which have a different error syndrome. For this reason, we can 
define correctness for *-decoders using identical diagrams to those for regular ideal 
decoders, but with the error syndrome changed in some way, which we do not need 
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to specify. I.e., a gate ExRec is correct for *-decoders if it satisfies 
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for some operation V on the error syndrome. {V of course depends on the errors 
in the original ExRec as well as the gate U .) The definitions for preparation and 
measurement ExRecs are similar; for the preparation ExRec, the error syndrome is 
brought in as a separate input on the RHS of the definition, and for the measurement 
ExRec, the error syndrome is discarded immediately after being produced. We then 
get the following lemma: 

Lemma 2. IJ an ExRec is correct for an ideal decoder, it is correct for a *- 
decoder. 

Proof. Note that the ideal decoder is just the *-decoder with the error syn- 
drome discarded. The definition of correctness for an ideal decoder must apply for 
all input states, including superpositions and parts of entangled states. This could 
not hold if the error syndrome output of the *-decoder had any further interaction 
with the data block after the action of the *-decoder. □ 

Thus, we also know that good extended rectangles are correct for *-decoders. 
We are almost ready to revise theorem[7]to take into account bad ExRecs as well as 
good ones, but there is one more complication. We would like to replace decoders 
with *-decoders in the proof of theorem [7] and push the *-decoders all the way 
through the circuit. However, I have declared that a ^-decoder should get pushed 
all the way through a bad ExRec to eliminate the leading EC step. That means 
that if we push a *-decoder backwards through a bad ExRec, the previous ExRec 
will be left without a trailing EC, and will no longer be an ExRec. 

Definition 10. An ExRec missing one or more trailing ECs (in the case of a 
multiple-qubit gate ExRec) is called a truncated ExRec. A truncated ExRec is good 
if it contains at most t faulty locations and is had if it is not good. Within a larger 
circuit, determine whether an ExRec should be good or bad and full or truncated 
by the following procedure: Start from the end of the circuit, with measurement 
ExRecs, and determine whether they are good or bad. For each other ExRec in the 
circuit, truncate it by eliminating a trailing EC step if that EC step participates as 
a leading EC in a bad ExRec (full or truncated). Once we know whether the ExRec 
is truncated (on all its output blocks, if there is more than one), determine whether 
it is good or bad. We can then determine recursively the nature of all ExRecs in 
the circuit. 

It is straightforward to define correctness for both regular ideal decoders and 
*-decoders for truncated ExRecs by just removing the trailing EC step from each 
diagram. 



Lemma 3. 
decoders. 



A good truncated ExRec is correct for both ideal decoders and 



Proof. Since the ideal decoder is supposed to incorporate a perfect error cor- 
rection, we could insert an EC gadget with errors before any ideal decoder without 
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changing the ouput at alL (We cannot do this before a *-decoder since the perfect 
EC gadget would clear the error syndrome.) Therefore, the correctness diagram for 
ideal decoders is effectively the same for full and truncated ExRecs, and it follows 
that a good truncated ExRec is correct for ideal decoders. Then, applying lemma[2] 
(which also works for truncated ExRecs), we find that a good truncated ExRec is 
correct for *-decoders as well. □ 

That leads us to the following improvement of theorem [7l 

Theorem 8. Suppose we have a fault-tolerant circuit C for C . Assign good 
and had extended rectangles to C , and produce a circuit C as follows: If the ExRec 
for C'i is good, include Ci unchanged in C. If the ExRec for C'i is bad, replace 
Ci by the erroneous gate U' from eq. i82\) or the corresponding equation for the 
correct type of location. The circuit C uses ancilla registers to control the types of 
U' errors. Then the output distribution of C is the same as the output distribution 
ofC. 

That is, C simulates a version of C with errors in place of the bad extended 
rectangles. We prove this theorem in the same way as theorem [71 by creating *- 
decoders at the right end of the circuit and pushing them back to the left using 
the correctness conditions and eq. (I82|) . The ancilla registers used to determine the 
type of errors are the error syndrome registers produced by the *-decoders. 

Finally, we are ready to talk about a concrete error model and to prove that 
fault tolerance reduces the error rate. 

Definition 11. An uncorrected error model assumes that each location Ci 
is faulty with probability pi, independently for different locations, and if there is 
an error at location d, it is chosen from some distribution Ei independent of the 
other locations. In an uncorrelated Pauli error model, if a location has a fault, there 
is probability pQi of Pauli error Q acting on the qubit(s) involved in the location 
(relative to the correct operation for that location). Usually, we assume that pi 
and PQi only depend on what type of location Ci is, and nothing else about it. 
Often, we assume that Pi = p for all i. An uncorrelated depolarizing error model is 
a special case of the uncorrelated Pauli error model where pQi does not depend on 
Q (except for Q = I, no error, which can be different). 

Uncorrelated Pauli error models, and particularly uncorrelated depolarizing er- 
ror models, are very convenient if one is doing simulations of fault-tolerant protocols 
to analyze their behavior and error tolerance. One reason for this is that EC steps 
for CSS and general stabilizer codes can be performed using only Clifford group 
gates, and thus the behavior of Pauli errors on a fault-tolerant circuit involving 
only logical Clifford group gates can be efficiently simulated on a classical com- 
puter. Under more general errors, the simulations quickly become unwieldy after 
only a few steps. 

However, any kind of uncorrelated error model is not going to be quite enough 
for us. The reason is that in theorem [8l even if the errors in C are uncorrelated, 
the location of good and bad ExRecs is somewhat correlated (because the ExRecs 
overlap, and whether an ExRec is truncated or not depends on whether the following 
ExRec(s) are good or bad). Furthermore, the type of errors in C are even more 
correlated, even entangled, because the type of error on a location Ci of C depends 
on the persistent error syndrome register produced by the *-decoder. Therefore, 
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even if C" has a simple uncorrelated error model, Pauli or otherwise, C will not. 
Instead, we have to go to a slightly more complicated type of error model. 

Definition 12. Consider a full circuit C and suppose with probability pg, 
there are faults at precisely the set S of locations, in which case the error at those 
locations can be any quantum operation consistent with the causal structure of S 
(i.e., if location Ci is chronologically before Cj, the error must act on Ci before Cj). 
Let Pi < 1 be fixed for each location d. For any set R of locations of C, suppose 
that the total probability of having faults on every location in R (and possibly 
additional locations outside R) is at most nis-R^**' Then we have a local stochastic 
error model. 

As before, we usually consider the case where pi only depends on the type of 
location C^, and often specialize to the case where pi — p for all i. In that case, 
the probability of having errors on all of a specified set of r locations is at most p^. 
Note that for this condition, we do not care what happens to locations outside the 
set R — some may have errors, others may not. In addition, we make no constraint 
on the type of error that occurs at any given location Ci with i Cz R. Often, we 
imagine that the type of error is chosen by an adversary who is determined to make 
our lives as difficult as possible. The adversary can choose errors that entangle 
different faulty locations; she may even choose to turn off the errors at some subset 
of locations if that will cause more trouble than leaving them on. However, the 
adversary is restricted to choose a strategy that has the probability of error on any 
given set of locations decreasing exponentially with the size of the set; it is in this 
sense that the error model is "local." There is another important restriction which 
is implicit in the above definition — we have assumed that the locations of the 
faults are chosen randomly, which is why it is a "stochastic" error model. This is 
not the most general possibility. We could have had a superposition of faults in 
different sets of locations, perhaps entangled with some environment qubits with 
persistent memory. It is possible to generalize the threshold theorem (theorem [TO]) 
to that case, but the details are somewhat complicated [3]. 

An uncorrelated error model will automatically be a local stochastic error 
model, with the same pi. However, as noted above, if C is subject to an un- 
correlated error model, then it does not generally follow that C will experience an 
uncorrelated error model as well. That is the advantage of generalizing to a local 
stochastic model: If C" is subject to a local stochastic error model, then C will also 
experience a local stochastic error model. 

Theorem 9 (Level Reduction). Suppose we have a fault-tolerant circuit C' 
for C , and suppose C experiences a local stochastic error model with error bounds 
Pi and probability ps of errors at precisely the set S of locations. Then for any 
particular set S define Cs as in theorem and define an error model on C by 
replacing C with Cs with probability p s . This is a local stochastic error model. The 
error hounds p[ for C are given by 



(84) 




R ieR 



The sum over R is taken over sets R of locations which are included in the ExRec 
for location Ci and with \R\ — t + 1. (Recall that t is the number of errors the 



QUANTUM ERROR CORRECTION 



41 



QECC corrects.) In the special case where pi < p for all i, we have 
(85) p', < Ap'+\ 

where A is the maximum over types of ExRecs of the number of sets of exactly t+1 
locations in the ExRec. 

Proof. By theorem [51 we know that the error model for C has a stochastic 
form, namely that for any set of locations 5", there is some probability p'g, of having 
faults at exactly the locations of S' . To calculate a bound on the probability of 
having errors at a set R of locations of C (and possibly elsewhere) , we should add 
up the probabilities ps of every set S of locations of C' which leads to bad ExRecs 
for locations Ci, i G R. 

For a single ExRec (say for the location Ci), we can upper bound the probability 
that it is bad by summing over all sets S which contain a subset R of locations 
which are included in the ExRec and have \R\ = t + 1. (Any set of locations with 
\R\ > t + 1 includes as a subset a number of sets with = < + 1, and is therefore 
already included in this sum.) By the union bound and the definition of a local 
stochastic error model, we therefore know that the probability of a single ExRec 
being bad is at most p-, with p- given by ([84|l . 

For a set of ExRecs given by the locations Ci, i S R', we sum over sets S 
which contain subsets of t + 1 locations in every ExRec in the set. If the ExRecs 
do not overlap, we get exactly the bound Jliefl' Pi ^^^^ way, considering S to 
contain a collection of sets Ri, \Ri\ = t + 1, Ri a subset of the ExRec for Ci. When 
the ExRecs overlap, we have to be slightly more careful, since the earlier ExRec 
is truncated for those cases where the later ExRec is bad, but that just means we 
sum over Ri which are contained in the truncated ExRec. To get back to Jligj?/ P'i^ 
we must add in extra sets of locations which include Ri intersecting the truncated 
EC step; this can only increase the bound, which is acceptable. □ 

It is for this theorem that we needed to truncate extended rectangles. When 
two ExRecs are completely separate, then in order for both to be bad, we need 
t+1 errors in each, and therefore the probability of having both be bad is at most 
p2(t+i) _ (p^)^ when Pi < p. However, for two overlapping rectangles, if we do not 
truncate, only t + 1 errors are needed for both to be bad if all the errors are in the 
shared EC step. Then the probability of both failing would be 0{p'^, not 0((p-)^). 

With some additional computational effort, we can actually set a tighter bound 
on p'^. While we have defined an ExRec to be bad when it has i + 1 or more faulty 
locations, there are some sets oi t + 1 locations (or more) for which the ExRec 
remains correct. One can define a malignant set of locations i? to be a set for 
which the ExRec is not correct for some set of errors at R. Then the sum in 
equation (|84p can be taken just over the minimal malignant sets of errors. 

Note that, when pi — p, the error rate p[ for C is less than the physical error 
rate p for C if Ap* < 1. In that case, we can apply the idea of concatenated coding 
to make the logical error rate arbitrarily small. The threshold theorem then follows 
easily from theorem [51 

Theorem 10. There is a threshold error rate px- Suppose we have a local 
stochastic error model with Pi < p < pt- Then for any ideal circuit C, and any 
e > 0, there exists a fault-tolerant circuit C which, when it undergoes the error 
model, produces an output which has statistical distance at most e from the output 
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of C . C has a number of qubits and a number of timesteps which are at most 
polylog{\C\/e) times bigger than the number of qubits and timesteps in C , where \C\ 
is the number of locations in C . 

Proof. As noted above, we use concatenated codes. We take an [[n, l,2t + 1]] 
QECC and create a sequence of circuits C'^^\ k = 1, . . . , L, where each C^*^^ is a 
fault-tolerant simulation of C'-''-^\ with C'-°^ = C. C" = C^^) under goes a local 
stochastic error model, and by theorem [U so does C^*^-* for all k < L. The local 
stochastic error model for C^'^^ has error bound pI^^''^ < , with 

(86) < A (p^^-^^y^^ - p^^"^^ (p^^-^^ Ipt) * , 

withpT = l/A^/*-. It follows that p^^V-PT < (p/pt)*+\ P^^Vpt < (p/pt)^*+^^' , and 

(87) P^'^Ipt<{pIptY'+''^' . 

The logical error rate after L levels of encoding thus decreases with L as a double 
exponential when p < pT- 

If we wish to achieve a final error rate of ei per location in C, we therefore need 
to choose 

(88) L = [log,+i [log(ei/pT)/ log(p/pT)]l ■ 

That is, for this choice of i, wc find that C undergoes a local stochastic error model 
with error bound pt < ei; this gives an upper bound on the probability of having 
a fault on location i. It therefore follows that the probability of having an error 
in some location of C is at most e — \C\ei. With probability 1 — e there are no 
faults in the simulated circuit C, and therefore the overall statistical difference of 
the output is at most e from the correct output distribution. 

The size of C" is given by L. The total number of qubits, including ancillas, 
involved in a fault-tolerant gadget is at most some constant G, as is the total 
number of time steps. Thus, the number of qubits and time steps involved in C^'^^ 
is at most G times the number of qubits and time steps involved in C^*^"^', and 
in particular, the number of qubits/time steps in C'-^-' is at most G^ times the 
number of qubits/time steps in G. Choosing L as in equation (|88p . we find 

(89) G^ < G[log(6i/pT)/log(p/pT)]'°^''/'°«^*+'^ . 

□ 

To be more explicit, we can choose a particular [[n, 1, 2t+ 1]] QECC and fault- 
tolerant protocol, and for that protocol determine A in equation ([85|) . Then the 
threshold for that protocol is at least px = XjA^I*'. By choosing a different code 
or protocol, or a different method of analysis, we might get a higher threshold, 
and the true threshold pt is the supremum over all possible choices. If we use 
the 7-qubit code and are careful counting malignant sets of errors, we find pt > 
2.73 X 10~^ [3l I41j . People have studied a variety of different codes and fault- 
tolerant protocols [llj . So far the best claimed thresholds have come in simulations 
by Knill |30| . who has used elaborate ancilla preparation techniques to achieve a 
threshold pt of as high as 5%, depending on the details of the error model. The 
current best rigorous lower bound on the threshold, using those same techniques, 
gives a threshold of 10~^ [31, |42]. 
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The threshold theorem can be improved in various ways. A similar theorem 
can be proven using more general noise produced by a weak interaction between 
the computer and a non-Markovian environment f3l 152] . This includes systematic 
errors — for instance, if every time we perform a Rg phase rotation, we over- 
rotate by a consistent small angle. The gadgets presented in this paper assume 
we can perform gates between arbitrary pairs of qubits, but it is also possible 
to devise gadgets which only involve nearest-neighbor interactions in one or two 
dimensions [H I23L I38L 1501 I51j . Most quantum gates have a tendency to mix 
different types of Pauli errors, but if you are careful, it is possible to design fault- 
tolerant protocols which can take advantage of a large asymmetry between X and 
Z errors [5]. When you attempt to optimize the threshold, it is generally at a large 
constant factor cost in overhead. There has been some study of the tradeoff between 
overhead and threshold value [6l I49j . but much more could be done in that 
direction. Recent work indicates that thresholds can be improved by not treating 
each level of concatenation separately, but by allowing the EC gadgets to use error 
information generated by the lower- level error correction procedures [6l I19|, I37j . 

Naturally, there are some assumptions inherent in theorem [10] that cannot be 
removed. As long as the physical wait location has non-zero errors, we cannot let 
any qubit wait around a long time without being corrected. That means that we 
must be able to perform operations in parallel; otherwise as the computer gets 
large, we could only correct errors on a vanishingly small fraction of the qubits 
at any given time. It also means we must be able to prepare qubits during the 
computation [2] . This is because we need to use ancilla qubits for error correction, 
and if the ancilla qubits were prepared only at the beginning of the computation, 
they would have accumulated a large error rate by the time they are used in an 
EC gadget. We must also assume the errors do not remove qubits from our com- 
puter irrevocably; either an error takes us to a valid physical computational state 
(albeit an incorrect one) or at least takes us to a state which can be restored by 
an appropriate action to some valid computational state. Finally, we need some 
sort of bound on the correlations present in the error model. The local stochastic 
model allows very strong correlations in the errors, but at least assumes that the 
probability of having an error on a particular large set of qubits decreases exponen- 
tially. This is roughly what we need in general; the non-Markovian model replaces 
this assumption with the assumption, roughly speaking, that the amplitude of a 
many-qubit error decreases exponentially. If instead we had merely a polynomial 
decay in the amplitude of many-qubit errors, there would be a polynomially-small 
chance that every qubit in the computer would fail simultaneously, and there is no 
way we could recover from such a big failure. 
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